11

I was confused when I opened my flash drive all I saw was a shortcut with its target as

C:\Windows\system32\rundll32.exe ~$WO.FAT32,_ldr@16 desktop.ini RET TLS " "

You may refer to the images I uploaded below. It shows the contents of the flash drive. The command prompt shows the hidden contents. You can see there that there is a with a blank name. It contains the contents of the flash drive. That directory also has a desktop.ini inside it with these as contents.

[.ShellClassInfo]
IconResource=%systemroot%\system32\SHELL32.dll,7
IconFile=%SystemRoot%\system32\SHELL32.dll
IconIndex=7

Unlike the first desktop.ini (found at the root of the flash drive). It has some kind of binary contents which frankly I don't know how to paste here. So I just uploaded the contents of the flash drive here. So you can view it yourself.

Another weird thing is the autorun.inf (which has only 0 bytes) is being used by the wuauclt.exe. You may refer to the second image below.

Has anyone experienced this too? I already did tried reformatting and reinserting the flash drive but still no luck.

contents of flash drive

autorun is locked

I hashed the desktop.ini (the binary-like one) and searched for it. It pointed me these links which was just posted a few days ago.

http://www.mycity.rs/Ambulanta/problem-sa-memorijskom-karticom-3.html

http://www.mycity.rs/Android/memoriska-kartica_2.html

desktop.ini (binary) d80c46bac5f9df7eb83f46d3f30bf426

I scanned the desktop.ini in VirusTotal. You may see the result here. McAfee-GW-Edition detected it as a Heuristic.BehavesLike.Exploit.CodeExec.C

I viewed the handles of wuauclt.exe in the Process Explorer and saw the autorun.inf is being used by the exe. You may also notice that a file from the temp folder is opened.

AppData\Local\Temp\mstuaespm.pif

Here is the scan of that pif file from VirusTotal. Here is an online copy of the PIF file and lastly, a random file that was generated after I ran the PIF file (I used sandbox).

wuauclt

  • It is turned on and I am using windows. So as far as I know, hidden files in Linux (.foldername) will still be shown in windows. (like the .Trash-0001 folder) – kapitanluffy Feb 22 '13 at 2:43
  • 1
    Maybe read up on this - irongeek.com/i.php?page=security/altds – cutrightjm Feb 22 '13 at 3:21
  • If that is the case, won't it be showing in the Explorer like desktop.ini:virus.exe instead of just desktop.ini? (assuming that desktop.ini contains the virus) – kapitanluffy Feb 22 '13 at 3:27
  • If you have read the post, I already uploaded it and provided the link. – kapitanluffy Feb 22 '13 at 3:33
  • start .\test.txt:note.exe did not work in win 7 it says that there is no program associated to perform the requested action. and indicates an access is denied in the command prompt – kapitanluffy Feb 22 '13 at 3:35
2

I successfully removed it a few days back already. Though I just posted this one right now. Here is how I removed the backdoor from my computer.

http://blog.piratelufi.com/2013/02/usb-flash-drive-contents-replaced-with-a-single-shortcut/

Just realized that the question itself is not a very good question. It is something more of a topic for discussion. Thanks for the 'protection' though.

| improve this answer | |
  • Damn, so it is a virus? I got this after plugging my flash drivce to a campus computer – deathlock Jun 5 '13 at 5:37
  • 2
    Please, avoid providing an answer that is just a link. – That Brazilian Guy Dec 21 '13 at 20:32
0

Use the command prompt to copy your files to your internal HDD (Make sure you have a virus software installed and fully updated before doing this) and then scan the files before formatting the drive, and then put the files back on the drive.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.