Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I just put an old flash drive which i used with a windows machine into my linux. I noticed many files, mostly exes which were never visible in windows (my windows does not hide hidden files and extensions). Most of those strange files had malware like names. I changed the properties of these files so that linux would allow me to delete them. It worked and now the drive seems to be fully clean.

If a windows malware in a flash drive can hide itself from windows, can it also hide itself from linux ? If not, then cleaning windows malware on a flash drive becomes easy.

share|improve this question
1  
Nothing is impossible. –  Terry Chia Mar 22 '13 at 1:55
    
Are there any dangers/problems in this strategy ? –  FirstName LastName Mar 26 '13 at 7:25
    
Should there be some discussion in the answer of wiping the USB stick to ensure its cleanliness? Removing (unlinking) individually identified malware files does not seem thorough really. –  adric Mar 26 '13 at 15:22
    
A side hint: Usually flash drive malware store an autorun.inf so that when you connect it to another windows, a naive user might have windows automatically execute it. Without an autorun, the mere existence of the malware (specially if they cannot be seen and therefore cannot be clicked by user) on the flash drive doesn't cause a threat. One way I have found against (at least current) flash drive malware is simply to create a directory named autorun.inf in the root of the flash drive. The malware doesn't suspect a directory and cannot write a file with the same name. –  Shahbaz Mar 29 '13 at 11:26
    
You can easily go through this process in Linux, usually you'll view what you want. If not you can always format, or run a flash scan with MBAM back on Windows or with Wine, which I've found to be more than reliable on more than one occasion. –  etsr Mar 31 '13 at 3:47
show 1 more comment

6 Answers

Yes there's a way to hide the a file from Windows' and Linux's file explorers, which is to start the file name with a dot . and set the h and s flags. In Windows that can be done by using the command line

ren file .file
attrib +h +s .file

Now the file cannot be seen by File Explorer, Nautilus, or Konqueror in their default settings on clean machines.

When you plug your flash disk in a Linux machine and open it using Nautilus, you may press Ctrl+H to show all hidden files. A better solution is to use your favorite shell to run this command in the flash disk's mounted directory.

ls -a

Note: If you "clean" the flash drive using Linux and then plug it back in the suspicious Windows machine, you can assume that it's infected again.

Update: I'll try to address your newly expressed concerns from a real-world and practical point of view.

First, in theory. There is a chance that the Linux machine is infected with malware that forces it to hide certain files (namely other malware files). But in reality, the chances are very slim. But like anything in security, you can never be sure.

Practically speaking, plugging your infected flash disk in a Linux machine and removing all the bad files (assuming you do know what all the bad files are) guarantees with a high probability that your flash disk is now clean. As long as you don't plug it back in the infected Windows machine, it's safe to use amongst other clean Windows machines (assuming you are sure about which machines are clean).

share|improve this answer
    
Do you mean that the flash drive is infected again when you say this - If you "clean" the flash drive using Linux and then plug it back in the suspicious Windows machine, you can assume that it's infected again. ? –  FirstName LastName Mar 26 '13 at 7:28
    
@FirstNameLastName Yes. If you have plugged it in an infected Windows machine and then cleaned it using a Linux machine, once you plug it back in the Windows machine you can assume it's immediately infected again. So until all your machines are clean, you can always assume that all the flash disks you use on them are infected. –  Adnan Mar 26 '13 at 7:34
    
@FirstNameLastName You seem to be looking for a more practical answer, I tried to address that in the last edit. –  Adnan Mar 26 '13 at 9:49
add comment

Malware Windows executable files on a Flash drive make sense only if they get, at some point, executed on a Windows machine. This requires that the files are "visible" to the said Windows, at least from the point of view of the operating system kernel. That the file are not seen through Windows file explorer means that the file explorer is either subverted (i.e. infected with malware of its own), or that it has a serious bug which prevents it from showing files. Either way, if the .exe files are visible from a Linux system but not from a Windows system, then chances are that the Windows system is corrupted. Cleansing the Flash drive is not enough to cure the disease...

Malware which infects both Linux and Windows is extremely rare; thus, it can be surmised, with a pleasantly high probability, that if a given Flash drive seems "empty" from both a Windows system and a Linux system, then it probably is really empty. This does not imply that either machine is itself "clean".

share|improve this answer
    
yes, the machine may not be clean. But, it would be nice to know if a flash drive will surely be clean if all bad exes/files can be removed inside linux. If true, then we can put other peoples flash in our linux, clean it and then out it in our windows. However, if a file can be hidden such that it is invisible in linux and windows, then we have a problem. –  FirstName LastName Mar 22 '13 at 7:50
    
If a file has a system flag set (say with attrib +s filename command) and the Explorer's "Hide protected operating files" option isn't disabled in options, then this file will not show in Explorer, but the system or applications won't have any problems reading it. Of course, disabling that Explorer setting should show files with a system flag in the list as well (and will always show with dir /a command), unless something more sinister is happening with your Windows system, as @ThomasPornin pointed out it might. –  TildalWave Mar 26 '13 at 9:22
add comment

There are a couple of ways this could be done, some quite esoteric such as patching the explorer.exe such that it will 'skip out' a specific blacklist of files created by the malware author.

Other methods are quite simple, such as the already mentioned system file attribute.

If this was an NTFS formatted drive, another very popular method amongst amateur malware authors is to use NTFS Alternate Data Streams, which Microsoft in their infinite wisdom decided to hide from both the explorer.exe program and the dir program, making them slightly difficult to dig up without the proper tools.

Only the latter method above, using Alternate Data Streams, will have any effect on Linux. If the proper NTFS kernel modules have not been installed, then ADS' are equally, if not more, difficult to spot on Linux unless you specifically go looking for them.

share|improve this answer
2  
Downvoters care to comment? –  lynks Apr 1 '13 at 19:32
add comment

It seems like you want to know how to safely clean the flash drive so there is no malware left on it when it gets plugged back into your windows machine. One guaranteed way to do this is to open up "Gnome Partition Editor" which is available on many linux distributions by default (including Ubuntu).

Warning this will delete all data on your flash drive, back up anything that you want to save from it (but don't back up the malware)

Upon opening this program you should see the various filesystems associated with your computer. Find your flash drive among them. under the options you should choose to reformat the flash drive (I recommend FAT 32 for a new filesystem type. It is the default for most flash drives). Once reformatted, all data should be gone and you should be good to go.

Here's a guide: http://www.ehow.com/how_4929061_format-hard-drive-ubuntu.html Note the drive you're looking for is your flash drive NOT your hard drive

If not, find yourself a copy of DBAN and write straight zeros through your flash drive. Then reformat it as above so you can use it again. This is time consuming and probably unneeded but if you are still worried, this will do the trick.

Guide: http://jesgru37.hubpages.com/hub/How-to-Wipe-a-Hard-Drive-Step-by-Step-Guide again, make sure the drive you're wiping is your flash drive. If something doesn't seem right, DONT DO IT! The changes made here are irreversible.

share|improve this answer
add comment

You don't have to be afraid of plugging potentially dangerous USB Drive to your Windows system if you configure it properly to prevent automatic infection.

You can, for instance, use gpedit.msc and go to:

- Computer Configuration
\ - Administrative Templates
 \ - Windows Components
  \ - AutoPlay Policies
    - Enable "Turn off AutoPlay" and select "All Drives"

This should prevent automatic infection of your system if a USB Drive with virus is connected. Still must be careful when trying to open the Pen Drive, because doing that by "double clicking the letter" will start the virus anyway. Instead, browse to the drive letter using the Windows Explorer address bar (type "E:\" for instance) and then with Show Extensions of Known file types and View System and Hidden files enabled, I presume you will be able to identify and eliminate potential threats even while using the operational system this virus was designed for.

share|improve this answer
add comment

First, yes, a hidden Windows file will be visible in Linux, and not only visible but modifiable, deleteable... You can do whatever you want. That's why one of the most important security best practices is not allow physical access to the system. You can imagine how harmful could be run a livecd. How to prevent this? Partition encryption.

Second, if the flash drive is empty in Linux, likely it is clean. Just remember to clean Windows before use it again.

share|improve this answer
    
looking for -1's explanation. –  yzT Mar 26 '13 at 16:37
    
What if they start the file with a `.'? Now it's also hidden on Unix and Unix-like operating systems. –  Sam Whited Apr 1 '13 at 0:04
    
When I wrote this, I had written a first sentence that said "Assuming you know how to check hidden files..." but I removed it due to that is a basic thing every user should know. Seems this is not the same for you. –  yzT Apr 1 '13 at 7:51
1  
Never assume they `should' know anything. That was the point of the users question (they didn't know). –  Sam Whited Apr 1 '13 at 13:34
1  
@yzT Let's remain polite, okay? –  Adnan Apr 2 '13 at 13:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.