Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

A flash drive funeral :(((


  • Please log in to reply
12 replies to this topic

#1 h2k47

h2k47

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:23 PM

Posted 18 September 2013 - 03:51 AM

Hello,

 I have an 8GB Ridata USB flash drive. My friend brought it to me yesterday and it appears that I fried it sad.gif but it would not hurt to ask around. Anyway, what happened was that the flash drive was acting 'weird' as it did not 'copy back' any folder that I would put on it.

I did a quick check disk and it reported errors and I opened the drive and found a bunch of hidden word files with 'exe' extension and an 'autorun.info' (yeaaa i know, VIRUSS). Trying to delete the files manually only reported a 'files are write protected error'.

Sooo, I embarked on the tedious process of cleaning the flash drive which apparently turned bad tongue.gif.

What I tried was:

1- Booted in safe mode and tried to delete the files manually but it did not work ( there was even no 'delete' option for the files on the flash drive in safe mode!!)

2- Formatting the drive also did not work as the files reappeared when using check desk and the problem persisted.

3- tried the old 'storagedevicepolicies' trick in registry but it still reported 'write protected files'.

4- Booted through win7 installation disk, clicked 'shift+F10' to bring the console and tried using 'diskpart' to clean the flash drive but all I met was the obnoxious error of 'the media is  write protected' sad.gif.

5-Tried 'low level' hard disk formatting tool but it did not work either.

6- Under the same cmd through win7 installtion disk, i tried to us an mbrfix tool but it could not do anything to the drive and reported it as write-protected as well.

I am totally sad and frustrated at how this turned out as I didn't expect that a silly virus would actually lead me to lose the pen drive.

Does anyone have a trick up their sleeves to help me with this or should I accept my destiny of buying a new pen drive for my poor soon-to-know friend? sad.gif

 



BC AdBot (Login to Remove)

 


#2 Sirawit

Sirawit

    Bleepin' Brony


  • Malware Response Team
  • 4,161 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Thailand
  • Local time:01:23 AM

Posted 18 September 2013 - 06:37 AM

Some flash drive have write protect switch on the side of it. Can you check is there any switch?

 

Thank you.


If I don't reply back to you in 2 days, feel free to send me a PM.

 

“You’re lying… just like you were lying to me before. You have to hate me. I’ve been the worst daughter in the world… you should hate me.”

“But I don’t, Nyx. Because, Nyx, I’m your mother, and a mother will always love her daughter, no matter what.” -Past sins by Pen stroke.


#3 Netghost56

Netghost56

  • Members
  • 973 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Texas
  • Local time:01:23 PM

Posted 18 September 2013 - 08:58 AM

Every flash drive I've ever purchased came with preinstalled software. You can delete them but a format will always bring them back- they're coded into ROM or something.



#4 h2k47

h2k47
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:23 PM

Posted 18 September 2013 - 10:29 AM

Nah there is no switch or anything Sirawit.

 

Netghost..I did not understand...what can i do?



#5 Netghost56

Netghost56

  • Members
  • 973 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Texas
  • Local time:01:23 PM

Posted 18 September 2013 - 10:45 AM

Try viewing the drive in Windows Explorer, but first change your folder options to "View

 

Tools-Folder Options-View-select "View hidden files and folders" - also DEselect "Hide protected operating system files".

 

Go here and download the Kaspersky Virus Removal Tool:

 

http://www.kaspersky.com/antivirus-removal-tool?form=1

 

If that doesn't work, you will need to remove the protected attributes from the files via command line. Here's a guide for that:

 

http://voices.yahoo.com/how-remove-autorun-virus-flash-drive-4630285.html



#6 h2k47

h2k47
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:23 PM

Posted 18 September 2013 - 07:11 PM

NetGhost

 

I think this would work if the drive does in fact have folders or can be scanned or even opened. The drive MBR i think got nuked as it does not show as 'actual' drive in My computer hence I cannot scan or format or remove anything. When I plug it in, Windows simply says I have to format the drive because it does not have a file system and I cannot format because it is a 'read-only' :((. Thanks for trying though.



#7 Netghost56

Netghost56

  • Members
  • 973 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Texas
  • Local time:01:23 PM

Posted 19 September 2013 - 08:47 AM

Can you access the drive properties in Explorer? There maybe be a read-only option that you can uncheck.

 

Ever used DiskPart?

 

Remove_write_protection_Diskpart_thumb.j


Edited by Netghost56, 19 September 2013 - 08:50 AM.


#8 h2k47

h2k47
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:23 PM

Posted 20 September 2013 - 08:05 AM

@Netghost

 

I tried it, it does clear readonly attributes but that is all! When trying the 'clean' command, it says disk is write protected :(.

Attached Files


Edited by h2k47, 20 September 2013 - 08:13 AM.


#9 Netghost56

Netghost56

  • Members
  • 973 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Texas
  • Local time:01:23 PM

Posted 20 September 2013 - 08:33 AM

Try this: (back up registry first!)
 

type in “regedit”.

 

Go to: HKEY_LOCAL_MACHINE\System\Current Control Set\Control

 

Check whether there is a key named “Storage Device Policies” to change the digit in the “DWORD value” box into "0" and press “OK”.

But, if you cannot find the key named “Storage Device Policies”, you can create one: right click “Control” to create a new key and name it as “Storage Device Policies”=> right click this new key to open “DWORD Value” and name it as “write protect”=> Double click it to change number.

 

EDIT: Also don't forget to reboot your system after making the changes before attempting to do anything with the flash drive.


Edited by Netghost56, 20 September 2013 - 08:39 AM.


#10 h2k47

h2k47
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:23 PM

Posted 20 September 2013 - 09:27 AM

@Netghost

 

Maan..sorry but did you read my post? I tried that.



#11 Netghost56

Netghost56

  • Members
  • 973 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Texas
  • Local time:01:23 PM

Posted 20 September 2013 - 09:56 AM

Sorry, I missed that.

 

I would just keep throwing antivirus scans at it- especially trojan/rootkit scanners.

 

I remember searching for a way to get a flash drive to read as a hard drive, changing the file system to NTFS, but I don't remember the steps, or if it will help.


Edited by Netghost56, 20 September 2013 - 10:05 AM.


#12 h2k47

h2k47
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:23 PM

Posted 20 September 2013 - 10:27 AM

This is how the flash drive is showed in My computer ( Removable Disk F). As you can see, it does not have a file system so it would not even be scanned by anything.

 

If anyone encountered the same problem, my advice is do NOT try the 'storagedevicepolicies' thing because after I tried it, I believe the drive started acting weird and busted itself. Just IMO.

Attached Files



#13 Netghost56

Netghost56

  • Members
  • 973 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Texas
  • Local time:01:23 PM

Posted 20 September 2013 - 02:15 PM

What information is available when you right click on it and select properties?

 

Flash drives are generally set up as FAT32 file systems. You can change one to NTFS by changing a setting in the device manager?(Can't remember actual steps, but I've done this before, trying to make a win7 boot live usb) but they are FAT32 by default.


Edited by Netghost56, 20 September 2013 - 02:17 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users