USB Flash Drive Question

[ZaLiTH]

My apologies if this is in the wrong thread, but I'm not sure which category this would really fall under... I figured 'general discussion' would be the safest.

Since getting Windows 7, I've had some interesting experiences with my flash drive... I've never used ReadyBoost on it, I'm always very careful with keeping antivirus definitions up to date, etc etc. But something very strange has cropped up on my flash drive. Just in case is matters; I'm using a 4gb MicroSD inside a tiny USB adapter (makes it nice and small).

When I bring my flash to work and plug it into my XP Pro machine, the autorun doesn't come up anymore, and trying to open it through My Computer shows in a completely new Explorer window, which it never used to do.

Looking on the drive, I see a hidden (i.e., it's grey because I show hidden files) icon of the recycle bin labelled as 'scanme', and my autorun.inf contains the following:

;é?????ämü??Í??à?s?ìõl???Q?I?O
[autorun
;fw?ALÊ???s&ÖOðsb?îvýðÞ
open=scanme/scanme32.exe

(rest of code removed as my NOD32 keeps closing this page now with a warning)

I somehow doubt this is normal for flash drives, and Windows 7 shouldn't affect it in this way, should it? I could backup my data and format, but is this really something I should be worried about? AVG (at home) and NOD32 v4 (at work) both say it's clean, and autorun still works on my Windows 7 PC... But it's a bit frustrating and confusing to say the least.

Also, I must note that a Google search for "scanme32.exe" as referenced in the autorun doesn't return anything, the closest is "scan32.exe" as part of the McAfee AV suite, but I don't use any computers with that on anyway..

Any ideas?

PS: If I try delete either file, I get no errors, but they are back again when I remove and reconnect my flash drive to my XP machine.

 

[Darryl Licht]

I have over a dozen USB flash drives... never seen this b4! Since it doesnt take long to format, yeah I'd say drag your data to a safe location and format the flash drive... should cure your ills!

 

[1Bowtie]

I'm wondering if it couldn't be the 2 different os's, 2 different anti virus scans one set up for xp and other for Win 7, just trying to think of reasons for error.

 

[gladson1976]

Anything with a recycle bin icon and the text scanme sounds extremely fishy to me.

I would suggest you scan the XP machine thoroughly first. Seems you might have something undesirable there.
Running a full scan on the 7 machine is also recommended.

 

[Darryl Licht]

A few questions/thoughts:

1. Have you at any point used this flash as a bootable drive?
2. The issue isnt 2 different OS'es... I swap my flash drives between OS'es all the time with zero issues.
3. Backup and formatting a flash is easy... just try it and see if this happens again.
4. What version of Win7 and where did you pick it up?
5. We used to use AVG at the college I teach at... seen too many bugs get past it... therefore I no longer use it. NOD32 is a great "basically unknown" AV with a very small footprint, it should have caught any malware on your flash drive when u scanned at work.
6. So I doubt it is infected... but it is indeed a bizarre one!

PLease keep us informed as to your progress.

 

[1Bowtie]

A few questions/thoughts:

1. Have you at any point used this flash as a bootable drive?
2. The issue isnt 2 different OS'es... I swap my flash drives between OS'es all the time with zero issues.
3. Backup and formatting a flash is easy... just try it and see if this happens again.
4. What version of Win7 and where did you pick it up?
5. We used to use AVG at the college I teach at... seen too many bugs get past it... therefore I no longer use it. NOD32 is a great "basically unknown" AV with a very small footprint, it should have caught any malware on your flash drive when u scanned at work.
6. So I doubt it is infected... but it is indeed a bizarre one!

PLease keep us informed as to your progress.

Darryl you are probably right, the thing i saw in first post its not a reg flash drive, it's an SD card put into a usb card reader was why i thought it might be the problelm.

 

[ZaLiTH]

Anything with a recycle bin icon and the text scanme sounds extremely fishy to me.

That's what brought my attention to it as well, didn't look too good.. As for scanning the XP / 7 machines; XP Pro is at work, my PC sits behind a Mako firewall and our count of blocked websites and ports runs into the thousands... NOD32 v4 is updated forcefully and weekly scans are run. My 7 PC at home doesn't ever see internet and I haven't been to a LAN party in months. But yeah, virus scan would be good... Lol.

A few questions/thoughts:

1. Have you at any point used this flash as a bootable drive?
2. The issue isnt 2 different OS'es... I swap my flash drives between OS'es all the time with zero issues.
3. Backup and formatting a flash is easy... just try it and see if this happens again.
4. What version of Win7 and where did you pick it up?
5. We used to use AVG at the college I teach at... seen too many bugs get past it... therefore I no longer use it. NOD32 is a great "basically unknown" AV with a very small footprint, it should have caught any malware on your flash drive when u scanned at work.
6. So I doubt it is infected... but it is indeed a bizarre one!

PLease keep us informed as to your progress.

Ok... Well, yes I have tried to use it as a bootable drive, and it didn't work.... My BIOS picked up the adapter but not the card inside. Surely formatting it would've cleared any boot records on it though?

I formatted with Win7 last night and at work this morning the suspicious files are back again. I'll try format here on my XP machine and see what happens though.

Win7 was an iso file from MS directly, with a software license bought online (no overheads for packaging or disks etc).

 

[WindowsStar]

I have seen this before. The flash memory is going bad, I have had several MicroSD go bad once I started using them on my computer. Worked great in my phone and camera but once I used it a lot it started doing what yours is doing. I formatted it many times and tried many things, ultimately replacing it fixed it. I read somewhere on line a while back that the MicroSD were prone to early failure.

 

[ZaLiTH]

I have seen this before. The flash memory is going bad, I have had several MicroSD go bad once I started using them on my computer. Worked great in my phone and camera but once I used it a lot it started doing what yours is doing. I formatted it many times and tried many things, ultimately replacing it fixed it. I read somewhere on line a while back that the MicroSD were prone to early failure.

You know.... I have heard that mentioned before, just never really thought about it. I've used this as a flash drive for over a year now, and for the most part it gets used on a daily basis. At least I have a 1GB normal flash drive that I can use, it's just been so handy having 4GB in my pocket wherever I go...

Well, had a bit of difficulty with formatting on XP, had to go through Disk Management and force a format. But after that, I removed the device and connected it again, and the files are back. It's not causing me any sleepless nights or difficulty with accessing files at least, only affected autorun on my XP machine, but I was just worried that it might be a virus that my AV couldn't detect...

Thanks to all for the suggestions, I guess I'll just try get as much life out of it as I can before it earns it's wings and moves on to USB heaven... :huh:

 

[Darryl Licht]

XP machines at work right? Are you in a domain at work? Perhaps your system admin can shed some light on this issue... Seems very strange that you format at either location and you are fine (no scanme file) until you stick it in the XP machine!

 

[ZaLiTH]

XP machines at work right? Are you in a domain at work? Perhaps your system admin can shed some light on this issue... Seems very strange that you format at either location and you are fine (no scanme file) until you stick it in the XP machine!

Yeah, I agree.. Tis very strange. However, today being Friday, the next time I'm back at work will be on Monday, so I'll bring my other flash drive from home and see how that reacts. Our network admin retired recently, and hasn't really been replaced as yet... Makes life interesting.

 

[garban]

scanme32

abiously, you hav some kind of virus in your computer, whenever you find an autorun.inf inside an usb memory or whatever you plug into your computer means that you have a virus, that's why you'll find it again even when you format your memory or delete the files manually, i have xp installed on my computer and have the same problem, in my opinion i think this is a new mutation of another virus and the antivirus doesnt have it registrared in their databases, that's why when you scan it says it's ok. i'm looking for any shot or something helpfull, if you find something respect to it, share with everybody please.

 

[Darryl Licht]

abiously, you hav some kind of virus in your computer, whenever you find an autorun.inf inside an usb memory or whatever you plug into your computer means that you have a virus, that's why you'll find it again even when you format your memory or delete the files manually, i have xp installed on my computer and have the same problem, in my opinion i think this is a new mutation of another virus and the antivirus doesnt have it registrared in their databases, that's why when you scan it says it's ok. i'm looking for any shot or something helpfull, if you find something respect to it, share with everybody please.

Not necessarily... many USB flash drives come preinstalled with software like U3. Could be that or a remnant of it.

 

[ZaLiTH]

Actually, I'm afraid it does look like it's a virus... NOD32 only started picking up on this a few days back after an update, I get a warning message as seen in the attached image.

I've had no luck with getting rid of it though, still trying... Spybot S&D found a few entries in my registry that were causing trouble, but nothing since that scan and still the issue persists.

 

[gladson1976]

Anything with a recycle bin icon and the text scanme sounds extremely fishy to me.

I would suggest you scan the XP machine thoroughly first. Seems you might have something undesirable there.
Running a full scan on the 7 machine is also recommended.

Actually, I'm afraid it does look like it's a virus... NOD32 only started picking up on this a few days back after an update, I get a warning message as seen in the attached image.

I've had no luck with getting rid of it though, still trying... Spybot S&D found a few entries in my registry that were causing trouble, but nothing since that scan and still the issue persists.

As I said earlier, a full scan is in order.

 

[ZaLiTH]

As I said earlier, a full scan is in order.

Full scan with NOD32 v3 fully up to date finds nothing, tried command prompt based tools from Grisoft (VCleaner.exe, various trojan horse cleaners, etc) still nothing, Symantec don't have any stand alone tools relating to this particular type of virus, AVG Free 9.5 full scan didn't find anything either.

The only time any AV software gives me a warning of any sorts is when I plug my flash drive in, and when I stop it using the 'Safely Remove Hardware' system tray option. This is driving me insane, I can't find the source of the problem...

 

[gladson1976]

how about formatting the flash drive from a linux live session (boot using Ubuntu Live CD and then full format the flash drive)

 

[ZaLiTH]

how about formatting the flash drive from a linux live session (boot using Ubuntu Live CD and then full format the flash drive)

No access to Linux here at work unfortunately, but I did delete the partition on my PC and create it from scratch on a clean PC, then once it was plugged into my PC again, the warning were back. Surely that would achieve the same thing?

The infection definitely looks like it's originating from my PC... :sarc:

 

[gladson1976]

Download Stinger (McAfee Threat Center) and run it on your PC. Also a fully updated version of SpyBot S&D.

 

[ZaLiTH]

Download Stinger (McAfee Threat Center) and run it on your PC. Also a fully updated version of SpyBot S&D.

No luck with Stinger either, the virus name that NOD32 shows in it's warnings isn't even included in the long list of viruses that Stinger can take care of.. And I've already got Spybot S&D, I'm a big fan of S&D, used it for years now.

Thanks for the suggestion though, I'll keep hunting until I find a solution....