I tried to have some business cards printed at a local print shop yesterday, who asked for the files on USB pen drive. Big mistake. I came away with an absurd heap of malware which (fortunately) Windows Security Essentials (Windows 7) quickly spotted and cleaned:
(that's Sality.AU, Lodbak.gen!lnk, Autorun.gen, Macoute.A, Sacanph.A)
I think they're all removed or quarantined, and I've run a scan of the only computer to have come in contact with this drive. The problem is, the contents of my USB pen drive now look like this:
That first nameless fake drive-within-a-drive seems to be where all my files are, judging from its size (12GB) and the fact that, when Security Essentials was scanning the drive, I could see my old files behind an odd path like d:\ \my folder\myfile.pdf
(note the space) as well as malware copies it removed like d:\my folder\myfile.exe
I'm not planning on opening it since I imagine that's part of how this virus propagates. Most of the files have backup copies, but there are a few files that I only got very recently that aren't yet backed up which I'd like to gain access to.
I've tried: using ATTRIB -H -R -S /S /D D:\
or ATTRIB -H -R -S /S /D D:
as suggested on this page, and using dir
to browse the drive, but both had odd results - it's aware that the USB stick is there and correctly identifies the manufacturer, but says "File not found" on trying to access it:
Also, I can save new files to the pen drive, but the command line resists cd
ing to it. Here's some testing after creating a directory called test
- when I cd
to a valid location, it just silently bounces off, when I cd
to an invalid location, it tells me:
Is there any way to (safely) unpack that fake drive-within-a-drive, or safely navigate within it to retrieve specific files?
Then after retrieving those specific files my plan is to format the drive and run another full scan of the computer, just in case.
And obviously, in future stick to print shops who take files by email or web link like dropbox...
Also, I put Lodbak.gen!lnk and Autorun.gen in the title because I believe it's one of those which is the specific one that created the drive-within-a-drive - probably Lodbak judging from the description - but I could be wrong. Please correct if I am.
cd
to anything on the pen drive but that's no big deal. If anyone wants to write that up as am answer I'll accept it./d
option tocd
, or explicitly change the drive with the commandd:
Or instead usepushd
(andpopd
later).