0

I know it sounds like a weird question, but hear me out. I have a lot of experience with virus & malware removal, but I haven't done any in a few years.

I recently attempted to do one so I did the following:

  • From a clean computer, I downloaded MSFT's malicious software removal tool & other virus/malware scanners/removal tools from Kaspersky and loaded them to a clean USB thumb drive.
  • I boot the infected Windows 10 machine into Safe Mode
  • I plugged in the thumb drive
  • I ran a Kaspersky scan. It detected 1 item, I then 'destroyed' that item.
  • I restarted the machine a few times.
  • However, now when I plugged back in the thumb drive it won't detect it at all.
  • I tested it in a working, clean computer (the one I am writing this question from), and it isn't showing up properly.
  • I see the "removable disk" show up EVENTUALLY (like literally 10 - 15 minutes after I plug it in) in my list of disks, but I can't browse it at all.

In other words, the thumb drive is no longer accessible on either the infected computer (in safe mode) or on a clean computer.

What could have caused this and how can I rectify this?

Edit 1

Another concern I have is, I am thinking the easiest approach may just be to wipe the drive clean and do a factory restore. I want to backup the existing data, however with this first thumb drive seemingly damaged I am hesitant to use another external drive to backup the data.

What are my options?

6
  • 1
    Of course it can. Malware can be any program out there. Software does exist that can disable drives and usb devices so therefore Malware can too
    – Eric F
    Jun 27, 2017 at 18:45
  • @EricF So the question is, how do I rectify this situation and restore the drive? Jun 27, 2017 at 21:02
  • Can you boot Linux? (it may be from live CD/DVD). Useful tools: lsblk, fdisk -l /dev/sdX (replace sdX with proper string like sdb; lsblk should tell you the right one, unless the drive is really damaged). Do you need to recover data from your thumb drive? or is making it work (as initially empty) enough? Zeroing the thumb drive MBR may bring it to life: dd if=/dev/zero of=/dev/sdX bs=512 count=1. If you're new to Linux then you'd better paste the output of said lsblk and fdisk first (you may call me in a comment then), and wait for further guidance before you use dd. Jul 4, 2017 at 18:20
  • I say put it this way.... If a registry setting can disable the use of thumb drive at the OS level , or another setting at the OS level can disable it entirely, then malware could potentially exploit that same method if the security context which it executes has permission so this is entirely possible for sure. Do an offline full AV scan with the OS not booted at all and scan everything with updated virus definition. Consider a full Malwarebytes scan afterwards as well just to be thorough. Jul 4, 2017 at 23:12
  • Can you format the flash drive? Jul 5, 2017 at 1:22

1 Answer 1

2
+50

There are quite a few possibilities to what happened to your thumb drive:

  1. It might be a simple issue where the partition got corrupted: In this case you can go to Computer Management > Disk Management> and check out what partition your thumb drive currently has. If it currently is in RAW format or is just unallocated, I suggest you unallocate the entire drive and make a new partition. It's possible that you can recover upto 99% of your files with a tool like EaseUS DataRecovery Wizard Pro.

  2. The malware corrupted your thumb drive's firmware: The malware that your thumb drive may have encountered may be similar to something like BadUSB. It may or may not have modified your drive's firmware to transmit malware, but in any case your thumb drive's pretty dead, and there's not much you can do about it.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .