2

I tried to have some business cards printed at a local print shop yesterday, who asked for the files on USB pen drive. Big mistake. I came away with an absurd heap of malware which (fortunately) Windows Security Essentials (Windows 7) quickly spotted and cleaned:

enter image description here

(that's Sality.AU, Lodbak.gen!lnk, Autorun.gen, Macoute.A, Sacanph.A)

I think they're all removed or quarantined, and I've run a scan of the only computer to have come in contact with this drive. The problem is, the contents of my USB pen drive now look like this:

enter image description here

That first nameless fake drive-within-a-drive seems to be where all my files are, judging from its size (12GB) and the fact that, when Security Essentials was scanning the drive, I could see my old files behind an odd path like d:\ \my folder\myfile.pdf (note the space) as well as malware copies it removed like d:\my folder\myfile.exe

I'm not planning on opening it since I imagine that's part of how this virus propagates. Most of the files have backup copies, but there are a few files that I only got very recently that aren't yet backed up which I'd like to gain access to.

I've tried: using ATTRIB -H -R -S /S /D D:\ or ATTRIB -H -R -S /S /D D: as suggested on this page, and using dir to browse the drive, but both had odd results - it's aware that the USB stick is there and correctly identifies the manufacturer, but says "File not found" on trying to access it:

enter image description here

Also, I can save new files to the pen drive, but the command line resists cding to it. Here's some testing after creating a directory called test - when I cd to a valid location, it just silently bounces off, when I cd to an invalid location, it tells me:

enter image description here

Is there any way to (safely) unpack that fake drive-within-a-drive, or safely navigate within it to retrieve specific files?


Then after retrieving those specific files my plan is to format the drive and run another full scan of the computer, just in case.

And obviously, in future stick to print shops who take files by email or web link like dropbox...


Also, I put Lodbak.gen!lnk and Autorun.gen in the title because I believe it's one of those which is the specific one that created the drive-within-a-drive - probably Lodbak judging from the description - but I could be wrong. Please correct if I am.

10
  • 1
    I've got a feeling that the "fake drive" was actually just a folder, with the icon changed to a drive symbol, and the filename set to some whitespace character Sep 19, 2015 at 11:19
  • Can you rename the directory with no name, say from Explorer using the F2 shortcut? Otherwise try a file recovery tool, like this one, maybe? piriform.com/recuva Another tip would be to right-click and go into the properties->Security->Advanced->Owner, and make sure your user is the directory/file owner? (from an administrator account): technet.microsoft.com/en-us/library/cc753659.aspx
    – miyalys
    Sep 19, 2015 at 12:09
  • Your USB drive was infected with what's commonly said as 'shortcut virus'. The 'drive' you see is a folder. You can easily change the folder name to whitespace using key combo. Check the folder properties, it should show the command path. But the command may be probably patched by your AV.
    – Nikhil_CV
    Sep 19, 2015 at 12:37
  • 1
    Okay, renaming the fake "drive" makes it seem to run as normal. I still can't cd to anything on the pen drive but that's no big deal. If anyone wants to write that up as am answer I'll accept it. Sep 19, 2015 at 12:53
  • 3
    To change to a directory on a different drive such as d: when you are on c:, you need the /d option to cd, or explicitly change the drive with the command d: Or instead use pushd (and popd later). Sep 19, 2015 at 21:38

6 Answers 6

1

My suggestion would first be to try to rename the folder that looks like a drive, which can, for instance, be done from Explorer by highlighting it and pressing F2. Maybe that will make it possible to CD into it and see the files.

If that doesn't solve it, I'd suggest taking a look at the folder permissions, and making sure your user is the owner of the files, from an administrator account. The reason is that if you aren't the owner, maybe this is why attrib fails? You should be able to find and change the permissions from an administrator account by right-clicking the folder and choosing Properties->Security->Advanced->Owner.
More info on how to do this: http://technet.microsoft.com/en-us/library/cc753659.aspx

Another idea would be trying to obtain the files via a file recovery tool. It looks like Piriform has a free version of Recuva, which you can get here: https://www.piriform.com/recuva

Edit: As for the cd'ing problem, courtesy of dave_thompson_085's comment, when you want to change to a different partition such as d:, you first need to write just

d:

...that is without cd in front, whereafter you can use cd to traverse the different folders on that partition.

3
+100

I've literally had this happen to me over a hundred times and it's always when I plug my thumb drive into a computer at a cyber cafe or a library computer, etc. It's ridiculously easy to fix though.

You were right about running attrib -s -h -r /s /d. That's pretty much all you need to do here. You could additionally run del /F /S /Q desktop.ini (after you've run the first command) to remove all folder customizations (e.g. a folder that looks like a hard drive partition)

Before you run either command, you should run this: cd /d X: (where X is the drive letter assigned to your pen drive)

It's also completely safe to explore the folder with no name (i.e. the   folder) as long as you don't click on anything suspicious inside, like an executable file you don't remember copying, a .BAT, .SCR, .COM, .VBS script, suspicious XLS, PDF, DOCX files, etc.)

Sometimes you run into a worm infection, an executable file that makes several copies of itself, looks like a folder icon and renames each of its copies to look like legitimate folders already present on your pen drive.

It's quite easy to remove this as well, even if you don't have an antivirus installed. I prefer to navigate to the root of the pen drive and enter *.exe size: xxx into the search box where xxx is the exact size of the executable file in bytes. This should give you a list of all malware executables on your pen drive that you can safely delete. You must exercise caution here though, because there's a (slim) chance that you have legitimate executable files on your pen drive that are the same size as the malware.

EDIT: I've never personally had problems with malware changing file/folder permissions but you never know, so you could also run the following two commands (after you've run cd /d X:):

takeown /r  /f X:\*
icacls X:\* /T  /L  /Q /C /RESET

X is the drive letter assigned to your pen drive.

0
1

The first and most important step is to hold off on writing anything to the USB. That means don't delete anything from the USB, don't rename anything on the USB, don't move any files on the USB, don't run chkdsk on the USB. Period. Any time you write on the drive, you are potentially permanently overwriting and destroying older, existing data that you wish to save!

Depending on how important the data on the drive is, before anything else, create a byte-by-byte clone of the drive. Using dd for Windows:

dd if=\\?\Device\Harddisk1\Partition0 of=backup.dat

Now you can run file recovery software on the partition, like the free Recuva and PhotoRec. More advanced tools exist like EasyRecovery Professional and NTFS-specific utilities, but they're paid and older (not recently updated or developed) while Recuva and PhotoRec/TestDisk have seen a lot of development and improvements in recent years.

You've already done a lot of writing and modifications to the filesystem after losing your files, so there's a chance your files are corrupted. Recuva and photorec will both show you the probability of properly recovering a file and how much of it is damaged or overwritten. Hopefully the files you value most are still there.

0

I always face this situation when I plug my Flash Drive into other people's PC.

I recommend you USB Show

Open USB Show and select your drive. It will unhide all the hidden folder and files. You will still have the "/" folder. Goto "/" folder and copy all folders and files to root of your Flash Drive. Hope it helps.

0

I think that your folder structure on the stick is in bad shape, and the problem is more serious than just a bunch of hidden files.

I suggest therefore that you treat your USB as broken, using data-recovery utilities, rather than standard Windows utilities, to recover the data.

If you do manage to get the data off it, reformat the stick before using it again (just in case), and deep-scan the recovered files before opening any of them, with your anti-virus and with Malwarebytes Anti-Malware.

A review of free data-recovery utilities can be found on Best Free Data Recovery and File Un-delete Utility, which includes the following utilities :

MiniTool Power Data Recovery
Recuva
TestDisk
PC Inspector File Recovery

Some more such utilities are mentioned in the comments section.

MiniTool Power Data Recovery gave me the best results when I had a broken disk, but the free version is limited.

0

There's a chance that other operating systems won't have a problem accessing the files on your memory stick. Rebooting your computer with an Ubuntu CD in the tray would be a harmless way to check and, assuming it does work, you can copy the files you'd like to keep over to your local disk.

While you're in the live environment, you can use the partition manager in Ubuntu to set up a new partition table for the memory stick. That way there's less of a chance that any hidden partitions (that the virus may have created) remain after you've formatted it.

2
  • +1 for suggesting a different OS. -1 for suggesting repartitioning while the data is still there Sep 20, 2015 at 19:10
  • Oh dear, that was a suggestion for what to do after he gets the data off. Sorry if I was being unclear.
    – tripflag
    Sep 21, 2015 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .