Instance 1. When normal operating flash drive is plugged in to be copied onto from the owner's pc, no shortcuts were copied, but actual folders and files saved on the desktop. When plugged into the recipient's pc, all the folder names are correct, however, they've all been magically turned into shortcuts. When I looked at the target, it shows a drive letter and strange screensaver file name, of all things (ie: F:\siodo.scr). Of course, the folders go nowhere and are all reduced to a kb.
Instance 2. My roommate used his portable hard drive with no apparent problem earlier today. His new camera uses MicroSD and he used an adapter to insert into his onboard card reader to download pictures. Same exact problem happened as in the first instance. He told me about it and before I thought to stop him, he plugged his hard drive back in. Again, same thing. However, the 500GB drive shows 298 used, which is about right for all the movies and misc pics that are on there. When the drive is opened and all folders selected, size amounts to a whopping 700+KB. Also, the icon representing the drive under My Computer has changed from a hard drive to a folder.
Instance 3. I did the unforgivable...I put his sd card in my laptop to diagnose. Good thing is, I'm well protected. After wiping it immediately, I scanned my computer. The virus detected was W32/Vobfus.EQ located directly under my user folder in the file jaemaat.exe. It obviously wasn't there or noticable before or I would've seen such a strange name.
So, I've noticed only the folders are affected, all computers involved are on the network provided over here and run by contractors, all the target locations seem like possible words or partial words/names of the contractor's leading nationality of employees, the contents of the drives are all desirable and/or valuable content, and the data seems to be there, but not accessible.
I know it's a lot of info, but I know it helps to have as much to work on as you can. Any help would be greatly appreciated, as people are starting to 'lose' precious information left and right over here with fewer people to pull from. Thanks.
Edited by hamluis, 30 August 2010 - 11:19 AM.
Moved from External Hardware to Am I Infected ~ Hamluis.