Pendrive affected by 'folder virus' and keeps remounting every two minutes or so.
I've a problem with my pendrive. I'm looking for some help. It
sure is a windows virus but it has corrupted my pendrive and
hence I'm seeking help here in linux forums. If this is not the
proper forum kindly move it to the proper one. But somehow
help me with the problem.
I don't know the exact name of this virus/trojan. I usually call
it 'the folder virus'. It creates an exe file by the same name as
the folder. The more folders you have the more exe files by their
name you have. Apart from these 'foldername.exe' files we can
sometimes see a file by name 'MicrosoftPowerPoint.exe' and/or
'autorun.inf'. All these days I either used the anti-virus s/w or
would login to linux and manually delete the exe files.
This time however the pendrive had an additional file by name
'VirusRemoval.vbs' apart from the exe files I named earlier. The
problem I faced this time is that the pen drive would auto-mount
several times. That way I had a terrible time in using linux to
remove the exe files and copying the data files. I persisted and
somehow managed to remove all the exe files. I then formatted the
pendrive. I thought that would have solved my problem and tried
to copy back the data to the pendrive. But to my horror the drive
again started to remount itself every two minutes or so, not
allowing me to copy back the files.
Let me add that the pendrive is a Transcend V30 series 4GB drive.
I searched for firmware but didnot find anything in their site.
Found a software called mFormat and used it to format the drive
again. But still no help. Whether I connect it to windows or
linux it doesnot matter, it just keeps remounting itself. It
either mounts as sdb1 or as sdc1. Whats wrong? How to get rid
of this? If I scan the pendrive it doesnot show any sign of virus.
The drive is almost dead now. Don't know what to do. Has anybody
faced similar problem. Can anybody help me with it.
Expecting a positive reply,
update on the virus problem
I tried the 'dd' command (with correct drive letter). But after that the
pendrive is NOT mounting at all... forget about the repeated auto-remounting...
I tried the mount command but it failed to mount. Below is
what I got for dmesg:
Can you make anything out of it?
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda3 10317860 7079232 2714508 73% /
tmpfs 485684 0 485684 0% /lib/init/rw
udev 10240 84 10156 1% /dev
tmpfs 485684 0 485684 0% /dev/shm
/dev/sda5 10472104 8251104 2221000 79% /mnt/datashare
/dev/sda7 20962544 20357200 605344 98% /mnt/media
/dev/sda9 15480800 5741084 8953336 40% /mnt/personal
SV-Debian:/media# mount -t vfat /dev/sdb1 /mnt/pd
mount: wrong fs type, bad option, bad superblock on /dev/sdb1,
missing codepage or other error
In some cases useful info is found in syslog - try
dmesg | tail or so
SV-Debian:/media# dmesg | tail
sdb: assuming drive cache: write through
SCSI device sdb: 8028158 512-byte hdwr sectors (4110 MB)
sdb: Write Protect is off
sdb: Mode Sense: 03 00 00 00
sdb: assuming drive cache: write through
sd 23:0:0:0: Attached scsi removable disk sdb
usb-storage: device scan complete
FAT: bogus number of reserved sectors
VFS: Can't find a valid FAT filesystem on dev sdb1.
And, I saw my modem 'reboot' immediately after the 'dd' command.
It was not the occassional disconnect. It rebooted completely.
Now, I don't know if it is related or just a co-incidence.
Now, when I log-into windows it gets auto-mounted repeatedly!
I scanned it with Avast Home edition. It does not find any
traces of virus in the pen drive. I also formatted it several
times but its of no use.
Now, I had connected my good drive and after I unmounted it and
connected the bad drive, the mount point of the good drive is still visible
in /media!!! Even with the (good) drive unmounted and disconnected from
the system, I'm able to cd into it! Here is what I saw:
Do you make anything out of it? :(
cdrom cdrom0 floppy floppy0 SAI VINOBA
SV-Debian:/media# rmdir SAI*
rmdir: SAI VINOBA: Directory not empty
SV-Debian:/media# ls -la SAI*
drwxr-xr-x 2 root root 4096 2008-04-13 11:28 .
drwxr-xr-x 5 root root 4096 2008-04-13 13:51 ..
-rw------- 1 root root 0 2008-04-13 11:28 .created_by_pmount
SV-Debian:/media# file ./SAI*/.creat*
./SAI VINOBA/.created_by_pmount: empty