3

I need some help here. I have an infected pendrive (unknown virus), what this virus is doing is just move my files to a hidden folder (.Trashes) and make links to those files (Actually the links doesn't work), also a weird visual basic script file keeps appearing in the hidden folder (There was too a .js file but this one didn't respawn), it's just a bunch of calls to function that doesn't seem to be anywhere.

First I tried just to erase those files and links. That didn't work and the script appeared again, moved my files to the hidden folder and created links again (almost instantly after erasing the file)

After that I tried to format the pendrive (Problem persisted).

I connected it to an old PC with old Debian (I never use this computer so no problem compromising it) with no internet connection and it started to do weird things, like menus not working properly and bash unusable after some commands (Changing to another runlevel and going back to the current runlevel solve the problem temporally). When I tried to login for example in runlevel 6 I couldn't login cause it put ^@ randomly when I tried to enter the username/password

For all those things I suspect that it has a rootkit installed which keeps recovering the virus. Is there a way to erase this rootkit? Could it be dangerous to connect the pendrive to a VM or Live CD in my current machine?

  • All kinds of things are possible, eg writing itself into your peripherals firmware to hide against drive formatting. But unlikely. On the other hand it seems like you have a rare windows and linux compatible virus. Or possibly just two viruses. Just throw the pendrive out. – Lyndon White Sep 21 '15 at 13:15
  • 2
    I couldn't login cause it put ^@ randomly when I tried to enter the username/password looks like it's a BadUSB drive that also enumerates as a keyboard and types in malicious commands to run some malware. Throw the drive away. – André Borie Sep 21 '15 at 13:37
2

After that I tried to format the pendrive (Problem persisted).

I'm afraid, it's because you computer is already infected.

Is there a way to erase this rootkit?

You can try to use a nice free utility named TDSSKiller, created by Kaspersky lab. It detects and removes widely spread rootkits and bootkits. BUT it works ONLY on Windows.

Also you can run Kaspersky Virus Removal Tool 2015 to check you Windows PC.

These two utils really saved me several times.

Could it be dangerous to connect the pendrive to a VM or Live CD in my current machine?

Yes, it can be dangerous. I wouldn't recommend to do this.

  • Thank you very much. About the windows computer which infected my pendrive, it's not mine (Public pc my father needed to use so...) About the tools you recommended, is there a way to securely connect the pendrive to a non-compromised Windows machine? The only pc I don't use anymore is the Debian one. Or it's just better to throw the pendrive? – Mr. E Sep 21 '15 at 15:52
  • 1
    If you don't have any important information on it, you better get rid of it. Consequences of infection could be much more expensive, like loss of sensitive data or compromising your online bank credentials, etc. – Oleg Sep 21 '15 at 16:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.