Find the answer to your Linux question:
Results 1 to 9 of 9
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Nov 2007
    Bangalore, India

    Pendrive affected by 'folder virus' and keeps remounting every two minutes or so.

    Hi all,
    I've a problem with my pendrive. I'm looking for some help. It
    sure is a windows virus but it has corrupted my pendrive and
    hence I'm seeking help here in linux forums. If this is not the
    proper forum kindly move it to the proper one. But somehow
    help me with the problem.

    I don't know the exact name of this virus/trojan. I usually call
    it 'the folder virus'. It creates an exe file by the same name as
    the folder. The more folders you have the more exe files by their
    name you have. Apart from these 'foldername.exe' files we can
    sometimes see a file by name 'MicrosoftPowerPoint.exe' and/or
    'autorun.inf'. All these days I either used the anti-virus s/w or
    would login to linux and manually delete the exe files.

    This time however the pendrive had an additional file by name
    'VirusRemoval.vbs' apart from the exe files I named earlier. The
    problem I faced this time is that the pen drive would auto-mount
    several times. That way I had a terrible time in using linux to
    remove the exe files and copying the data files. I persisted and
    somehow managed to remove all the exe files. I then formatted the
    pendrive. I thought that would have solved my problem and tried
    to copy back the data to the pendrive. But to my horror the drive
    again started to remount itself every two minutes or so, not
    allowing me to copy back the files.

    Let me add that the pendrive is a Transcend V30 series 4GB drive.
    I searched for firmware but didnot find anything in their site.
    Found a software called mFormat and used it to format the drive
    again. But still no help. Whether I connect it to windows or
    linux it doesnot matter, it just keeps remounting itself. It
    either mounts as sdb1 or as sdc1. Whats wrong? How to get rid
    of this? If I scan the pendrive it doesnot show any sign of virus.

    The drive is almost dead now. Don't know what to do. Has anybody
    faced similar problem. Can anybody help me with it.

    Expecting a positive reply,


  2. #2
    SuperMod (Back again) devils casper's Avatar
    Join Date
    Jun 2006
    Chandigarh, India
    I have never faced such problem but it looks like problem is with PenDrive only. Try wiping Pen Drive using 'dd' command.
    dd if=/dev/zero of=/dev/sdc bs=521 count=1
    Be careful while executing 'dd'. Make sure to type correct device name.
    It is amazing what you can accomplish if you do not care who gets the credit.
    New Users: Read This First

  3. #3
    Just Joined!
    Join Date
    Nov 2007
    Bangalore, India

    update on the virus problem

    Hi Casper,
    I tried the 'dd' command (with correct drive letter). But after that the
    pendrive is NOT mounting at all... forget about the repeated auto-remounting...

    I tried the mount command but it failed to mount. Below is
    what I got for dmesg:
    SV-Debian:/media# df
    Filesystem           1K-blocks      Used Available Use% Mounted on
    /dev/sda3             10317860   7079232   2714508  73% /
    tmpfs                   485684         0    485684   0% /lib/init/rw
    udev                     10240        84     10156   1% /dev
    tmpfs                   485684         0    485684   0% /dev/shm
    /dev/sda5             10472104   8251104   2221000  79% /mnt/datashare
    /dev/sda7             20962544  20357200    605344  98% /mnt/media
    /dev/sda9             15480800   5741084   8953336  40% /mnt/personal
    SV-Debian:/media# mount -t vfat /dev/sdb1 /mnt/pd
    mount: wrong fs type, bad option, bad superblock on /dev/sdb1,
           missing codepage or other error
           In some cases useful info is found in syslog - try
           dmesg | tail  or so
    SV-Debian:/media# dmesg | tail
    sdb: assuming drive cache: write through
    SCSI device sdb: 8028158 512-byte hdwr sectors (4110 MB)
    sdb: Write Protect is off
    sdb: Mode Sense: 03 00 00 00
    sdb: assuming drive cache: write through
     sdb: sdb1
    sd 23:0:0:0: Attached scsi removable disk sdb
    usb-storage: device scan complete
    FAT: bogus number of reserved sectors
    VFS: Can't find a valid FAT filesystem on dev sdb1.
    Can you make anything out of it?

    And, I saw my modem 'reboot' immediately after the 'dd' command.
    It was not the occassional disconnect. It rebooted completely.
    Now, I don't know if it is related or just a co-incidence.

    Now, when I log-into windows it gets auto-mounted repeatedly!
    I scanned it with Avast Home edition. It does not find any
    traces of virus in the pen drive. I also formatted it several
    times but its of no use.

    Now, I had connected my good drive and after I unmounted it and
    connected the bad drive, the mount point of the good drive is still visible
    in /media!!! Even with the (good) drive unmounted and disconnected from
    the system, I'm able to cd into it! Here is what I saw:
    SV-Debian:/media# ls
    cdrom  cdrom0  floppy  floppy0  SAI VINOBA
    SV-Debian:/media# rmdir SAI*
    rmdir: SAI VINOBA: Directory not empty
    SV-Debian:/media# ls -la SAI*
    total 8
    drwxr-xr-x 2 root root 4096 2008-04-13 11:28 .
    drwxr-xr-x 5 root root 4096 2008-04-13 13:51 ..
    -rw------- 1 root root    0 2008-04-13 11:28 .created_by_pmount
    SV-Debian:/media# file ./SAI*/.creat*
    ./SAI VINOBA/.created_by_pmount: empty
    Do you make anything out of it?

  4. $spacer_open
  5. #4
    Linux Guru bigtomrodney's Avatar
    Join Date
    Nov 2004
    Well dd was being used to wipe the drive, you will need to format it again now before it can be mounted. Try using gparted if you can.

  6. #5
    Just Joined!
    Join Date
    Nov 2007
    Bangalore, India
    hi 'big' brother,

    I tried that too. I did 'dd' as 'casper' told with correct drive letter for my thumbdrive and
    then used gparted (coz, in debian i was not able to find the format command, even while
    in root account!) to formated it. Now, strangely though the repeated automounting in
    linux has stopped but it is continuing under windows!

    One senior in one of the other forums suggested to check if 'FUSE' is enabled in my set-up
    of Debian. How to check if it is enabled? If that is enabled can that be a cause of this
    behaviour? In that case isn't it a bad idea from security point of view to enable FUSE by
    default, coz I did not enable it...

  7. #6
    Linux Guru bigtomrodney's Avatar
    Join Date
    Nov 2004
    I wouldn't be worried about FUSE at the moment, if it's continuing in Windows after a reformat this would point to my first gues when I read this thread which is that the USB drive is faulty.

    It could be anything froma faulty controller chip to a bad connection on the jack. I have seen drives becoming hit and miss after being bent slightly or submitted to pressure. Does this sound likely to you?

  8. #7
    Just Joined!
    Join Date
    Nov 2007
    Bangalore, India
    Update to my earlier post...It still automounts repeatedly in Debian albeit not at the rate it remounts in Windows.

    Well, I'm little rough in handling devices...but infact the affected drive
    is of my friend. Don't know how he has handled it. After he gave it
    to me to check I might have plugged it in and taken out roughly.

    But, seriously does that matter so much? In that case what can be
    done now?

  9. #8
    Hi all friend. I am using linux Fedora version.
    while formating my pendrive using command #/sbin/mkdosfs -F32 -I /dev/sda , I formatted my pendrive. But I also used both sda and sda1. After this, my system is not booting and asking to insert some bootable cd.

    What should I do and can i recover my data. I was having both windows xp with 120GB partition and linux Fedora with 40GB partition.
    Please guide me.

  10. #9
    Just Joined!
    Join Date
    Nov 2007
    Bangalore, India

    did you say /dev/sda???

    Hi subrat,
    If you have a harddisk connected the usual way and you connect a pendrive, its usually /dev/sda for harddisk and /dev/sdb for the pendrive or any other drives. sda1, sda2... or sdb1, sdb2...etc denote the partitions on those physical drives.

    I'm afraid you have erased your harddisk and all your data has gone and the only option you have is to reinstall both windows xp and linux. I would love to be wrong though...

    You should always excise extreme caution when using commands like format, dd etc. Even if you are an expert user...

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts