1

Let's suppose I plugged in my UBS flash drive in my friends' PC and it got infected with malware. Is there a way I can wipe the USB drive without connecting it my or some other computer (and infecting it in the process)?

  • 1
    There are ways to clean infected devices, but they require fairly specialist knowledge, especially if they involve firmware manipulation. Given the price of flash drives, you're better off physically destroying it and buying a replacement unless you have that specialist knowledge. – Matthew Nov 19 '15 at 13:04
  • 2
    Flash drives are cheap - if you know it is infected, and don't need to recover any data from the drive, destroy it and get a new one. Then be more careful where you use it. – JonnyWizz Nov 19 '15 at 13:17
3

You can plug your USB drive on a virtual machine based on Linux. Before that, you can stop the automatic mount of externals drives.

After, you verify the recognition of your drive with:fdisk -l

You note his path: /dev/sdX, don't mistake with another drive !!!

You note his blocks count and their sizes (512 by default)

You can erase all datas on the drive with:

dd if=/dev/zero of=/dev/sdX count=<blocks count> bs=<blocks size>

After that, your drive will be totally erased. If you are paranoid, you can delete you virtual machine too. This method doesn't clean the potential infected firmware of your drive.

  • Interesting. Can I load Tails from a DVD, for instance, and format the flash drive using it? – David Bryant Nov 19 '15 at 13:45
  • @DavidBryant I don't know Tails, but dd command is a common command in Linux distribs. So, you can boot on this, and execute the commands – Sorcha Nov 19 '15 at 14:32
  • I meant, I could also load my Linux GUI (Tails, Ubuntu, DSL, etc), stick in infected flash drive and just format it with the equivalent of "My computer"? – David Bryant Nov 19 '15 at 14:58
  • 1
    @DavidBryant yes, but you increase your attack surface (which is still minimal as common Windows malware don't try to exploit Linux apps) by making a fairly large GUI program to parse the drive's metadata, and it may only be able to format into Linux filesystems, making your drive useless on Windows. It also won't wipe potential data outside of the partition boundaries nor in the MBR. dd is a safe option, doesn't attempt to read & parse data from the drive and wipes everything. An alternative is to use shred -n 1 -v /dev/sdX. – André Borie Nov 19 '15 at 20:38
0

If it was just an autorun, connect it to a non-windows computer and take a look at the files. There should be an "autorun.inf" file that references some other file(s). Delete them and everything (should) be okay. Or delete everything you don't know just to be sure.

Be aware that it is not a panacea. If the infection put a payload inside your executable, PDF or office document (or some other type of) files, you will not know it until you pass them through a scan.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.