Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Usb infected with vobfus: can't remove write protection in that usb.


  • Please log in to reply
11 replies to this topic

#1 cadeteh

cadeteh

  • Members
  • 47 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:26 AM

Posted 20 December 2017 - 05:30 PM

 Greetings. My usb has been infected with the vobfus virus, (the one that writes in an usb files like: passwords.exe, porn.exe, secret.exe, sexy.exe, subst.exe, and system.exe), the problem is that the usb is             write-protected and I can't remove the write-protection. Any help would be appreciated.

 

 

 

 

Thanks In Advance!


Edited by hamluis, 20 December 2017 - 05:49 PM.
Moved from MRL to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


#2 JohnC_21

JohnC_21

  • Members
  • 24,310 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:26 AM

Posted 20 December 2017 - 06:54 PM

Open an elevated command prompt. Type the following commands.

 

diskpart

list disk

select disk X                          Where X is the number associated with your flash drive

attributes disk                       Does it say the drive is read only? If yes type the next command

attributes disk clear readonly


Edited by JohnC_21, 20 December 2017 - 06:54 PM.


#3 cadeteh

cadeteh
  • Topic Starter

  • Members
  • 47 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:26 AM

Posted 20 December 2017 - 07:20 PM

Open an elevated command prompt. Type the following commands.

 

diskpart

list disk

select disk X                          Where X is the number associated with your flash drive

attributes disk                       Does it say the drive is read only? If yes type the next command

attributes disk clear readonly

 It says it's not read only.

 I tried the diskpart before several times and I got no success.

 Thanks for trying to help me.



#4 JohnC_21

JohnC_21

  • Members
  • 24,310 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:26 AM

Posted 20 December 2017 - 08:14 PM

Do the following and be very careful you are selecting the correct disk because we will be wiping it. Open a command prompt and type

 

diskpart

list disk

select disk X    Your USB flash drive

clean all           This will zero wipe the disk including any data on the flash drive

exit

 

You will know the wipe has completed once you see the diskpart command prompt again.  Once wiped you can partition and format again. I can give instructions on that unless you tried clean all before and it failed. In that case there is something else to try.



#5 cadeteh

cadeteh
  • Topic Starter

  • Members
  • 47 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:26 AM

Posted 20 December 2017 - 11:53 PM

Do the following and be very careful you are selecting the correct disk because we will be wiping it. Open a command prompt and type

 

diskpart

list disk

select disk X    Your USB flash drive

clean all           This will zero wipe the disk including any data on the flash drive

exit

 

You will know the wipe has completed once you see the diskpart command prompt again.  Once wiped you can partition and format again. I can give instructions on that unless you tried clean all before and it failed. In that case there is something else to try.

When I enter the "clean all" command, it says this, " DiskPart has encountered an error: The request can not be made for an I / O device error.

See the system event log for more information."


DiskPart has encountered an error: The request can not be made for an I / O device error. See the system event log for more information.



#6 JohnC_21

JohnC_21

  • Members
  • 24,310 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:26 AM

Posted 21 December 2017 - 08:10 AM

Download Partition Wizard. Run the program with the USB attached. Does it list the USB as bad?

 

https://www.bleepingcomputer.com/download/minitool-partition-wizard-free/



#7 cadeteh

cadeteh
  • Topic Starter

  • Members
  • 47 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:26 AM

Posted 21 December 2017 - 11:33 AM

Download Partition Wizard. Run the program with the USB attached. Does it list the USB as bad?

 

https://www.bleepingcomputer.com/download/minitool-partition-wizard-free/

It says it's read only, and in the left corner it says "0 operations pending"



#8 JohnC_21

JohnC_21

  • Members
  • 24,310 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:26 AM

Posted 21 December 2017 - 12:02 PM

Firstly, see this page. Method 4 may be able to correct the problem

 

If there isn't a physical switch to make the USB read only this could be a firmware fault but I don't understand why diskpart said the drive was not read only. 

 

If a firmware fault there is no way to make the drive read-write outside of burning new firmware.

 

Booting a live linux partition manager called Gparted may be able to let you delete the partitions and reformat the drive. Burn the iso to a CD. Boot Gparted. In the upper right is a dropdown box where you select the device. If you only have one hard drive in the computer it would be sdb, sda being the hard drive. You need to make sure you are dealing with the correct device. 

 

Delete all partitions by creating a new partition table then create a primary NTFS partition.  You need to click the green checkmark or Apply to finish all the steps.

 

https://gparted.org/livecd.php

 

https://www.dedoimedo.com/computers/gparted.html

 

For the price of a USB flash drive it may not be worth it though.

 

Select Device: Make sure it is the correct device

gparted-choose-device.jpg

 

Create New Partition Table

gparted-create-partition-table.jpg

 

gparted-warning.png

 

Create a Primary Partition formatted NTFS. Partition > New

gparted-create-new-partition-types.jpg

https://www.youtube.com/watch?v=O5kh_-6e4kk

If you can't do the above with Gparted then I would say your USB flash drive is finished.

 

 

 



#9 cadeteh

cadeteh
  • Topic Starter

  • Members
  • 47 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:26 AM

Posted 21 December 2017 - 12:11 PM

Firstly, see this page. Method 4 may be able to correct the problem

 

If there isn't a physical switch to make the USB read only this could be a firmware fault but I don't understand why diskpart said the drive was not read only. 

 

If a firmware fault there is no way to make the drive read-write outside of burning new firmware.

 

Booting a live linux partition manager called Gparted may be able to let you delete the partitions and reformat the drive. Burn the iso to a CD. Boot Gparted. In the upper right is a dropdown box where you select the device. If you only have one hard drive in the computer it would be sdb, sda being the hard drive. You need to make sure you are dealing with the correct device. 

 

Delete all partitions by creating a new partition table then create a primary NTFS partition.  You need to click the green checkmark or Apply to finish all the steps.

 

https://gparted.org/livecd.php

 

https://www.dedoimedo.com/computers/gparted.html

 

For the price of a USB flash drive it may not be worth it though.

 

Select Device: Make sure it is the correct device

gparted-choose-device.jpg

 

Create New Partition Table

gparted-create-partition-table.jpg

 

gparted-warning.png

 

Create a Primary Partition formatted NTFS. Partition > New

gparted-create-new-partition-types.jpg

https://www.youtube.com/watch?v=O5kh_-6e4kk

If you can't do the above with Gparted then I would say your USB flash drive is finished.

 

 

 

 I can't do the steps above, and I've done the 4th method before. XD

 

 Do you know what must I do to my dead usb now?

 

 R.I.P 8gb usb :'v


Edited by cadeteh, 21 December 2017 - 12:12 PM.


#10 JohnC_21

JohnC_21

  • Members
  • 24,310 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:26 AM

Posted 21 December 2017 - 12:16 PM

Why can't you do the Gparted steps? Because of burning a CD? You could use Rufus with a spare flash drive to create a bootable USB flash drive of Gparted. Personally, I would do exactly what you said, R.I.P., and get a new one. 



#11 cadeteh

cadeteh
  • Topic Starter

  • Members
  • 47 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:26 AM

Posted 21 December 2017 - 12:28 PM

Why can't you do the Gparted steps? Because of burning a CD? You could use Rufus with a spare flash drive to create a bootable USB flash drive of Gparted.

 Basically because I would waste my time. XD

 

 

 

Personally, I would do exactly what you said, R.I.P., and get a new one. 

Yep. Do you know what must I do to the usb now? Or any place or method to get rid of the usb?



#12 JohnC_21

JohnC_21

  • Members
  • 24,310 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:26 AM

Posted 21 December 2017 - 01:46 PM

You can open it then destroy it with a hammer. 






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users