|
-
January 24th, 2006, 11:28 PM
#1
backdoor infected removable usb drive
Is there a way to plug this in and clean it without infecting the computer it is plugged into? Or is the better option to take a hammer to it and buy a new one ?It is a 256mb USB drive
I had to wipe and reinstall the OS on the computer it was infected by as the entire system was so trashed there was no way to get it all the way clean and safe(my opinion). I transfered some programs to the infected computer and when I went to transfer another program ,it(program on the removable drive) was inaccessable due to the infection. All the icons turned into windows media icons and all the shortcuts were gone as was system restore and all the spyware programs and anti-virus programs on the computer.
I use the drive to install reepair programs on computers I am working on away from home.
Ideas or suggestions on saving the drive anyone ?
KennJ
Last edited by kenn jolemore; January 24th, 2006 at 11:32 PM.
Reason: clarity
-
January 25th, 2006, 12:14 AM
#2
I haven't had to face this situation yet but as much as I use flash drives, I probably will someday...
I would hold down one of the shift keys and insert the drive. This will keep any autorun programs that might be on the drive from starting. Then I'd scan the drive with the AV on the host PC.
I have one of the new U3 drives that comes with it's own free AV (in my case, McAfee AV on a Memorex drive.) The on board McAfee AV is manual scanning only (no real-time) but I imagine I would scan the drive with it too...
-
January 25th, 2006, 07:03 AM
#3
Kenn: Without giving away anything personal, can you give more details as to what program/data you believe is infected on the USB drive?
If (and dealing with me, that's a BIG "IF") I understand correctly, the PC you were working on went bad. But the USB drive may be ok?
-
January 25th, 2006, 09:50 AM
#4
Hijackthis was inaccessable acording to the computer as was the cloaking program for addAware. When I tried to access them their icons had turned into windows media file icons and I got a "can not locate the file" type message from the infected computer.
For certain at least two backdoor items were on the computer and I am not sure what else might have been there. The computer belongs to my brother and he had downloaded a video file from a site he uses regularly. It used the Windows meta file exploit that has started back up recently to infect the computer.
You wrote:"If (and dealing with me, that's a BIG "IF") I understand correctly, the PC you were working on went bad. But the USB drive may be ok?"
That is a correct assumption as I went ahead and wipped the hard drive of the computer but was unable to use the OS on it to clean the USB drive before hand as the computer was beyond use at that point.
KennJ
-
January 25th, 2006, 10:40 AM
#5
Well, based on your post above, my feeling is that it should be ok to plug the USB drive into an up to date PC and scan it from that PC. I would go ahead and do the "hold down the shift key" thing as you insert the drive to be on the safe side, but IMO, I doubt it will be infected.
At this moment, I can't think of any malware that could move from portable media to the PC unless something from the PC starts it in motion...
-
January 25th, 2006, 10:48 AM
#6
I am leaning in that direction myself as nothing I have read suggests that there is a potential for cross over from the drive. Of course should it happen I know I will wish I tossed the darn thing in the garbage while I am reinstalling yet another system.
I think I will give it another day of thought first just in case :0)
KennJ
-
January 26th, 2006, 11:20 AM
#7
Well, I plugged in the drive and scanned it for viruses and there were none according to McAfee, than I tried to access the drive and was unable to do so. Instead the computer asked if I wanted to format the drive. I tried both no and yes and was unable to get into the drive either way. Now I am scanning the computer and checking it out to make sure I did not infect anything when it was plugged in as the problem is as much spyware as virus.On top of the virus program the computer has Spybot , AdAware,SpywareBlaster, and microsoft's anti-spyware running and updated so I would think I am OK.
Suggestions or ideas other than tossing it and letting it go anyone?
KennJ
-
January 26th, 2006, 07:09 PM
#8
kenn: I'm inclined to think it's not infected but corrupted by the infected PC you were working on. Some flash drive makers have reformating software for their drives. You might see if any exist. Otherwise, if a PCs attempts fail, the drive may be toast...
Thread Information
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|