2

Recently I bought this external hard drive from Amazon ("Sold by: Amazon.com Services, Inc").

The first time I plug it into my computer, Malwarebytes shows this report (it found bitcoin miners in my Downloads directory):

enter image description here

D: is my existing drive and the Downloads directory is my default downloads folder.

Is my system screwed?

6
  • Wow, a drive sold by Amazon themselves had malware on it? I would contact them immediately. No, your system is probably ok, thank MalwareBytes.
    – Henry F
    Oct 8, 2018 at 3:26
  • 1
    @HenryF Amazon is like eBay in that it lets individuals sell products. Not all the products are verified by Amazon or are delivered from official sources.
    – forest
    Oct 8, 2018 at 4:05
  • First, most AV will disabled autorun by default. Second, did you make a throughout scan on the external storage? There are many details missing to draw a solid conclusion.
    – mootmoot
    Oct 10, 2018 at 8:11
  • I'm confused. If D is your existing drive, why is this Amazon drive being mentioned at all? Was it plugged in before or after 1:44pm (the time stamp on the files in the quarantine)? Oct 10, 2018 at 10:56
  • @schroeder Autorun is enabled. The moment I plugged the device in (timestamp), malwarebytes showed the quarantine message.
    – Newbbit
    Oct 10, 2018 at 21:05

2 Answers 2

2

From the report, it seems your antivirus stopped the programs before it could have done anything. I would just flash the hard drive and use it or return it and get a new one. As for why it was there I'm guessing someone purchased the hard drive and put the files there then returned it hoping someone would install it by mistake.

PS: As a safety measure I would scan the whole PC with the antivirus.

3
  • He may need to want to keep the drive. If it's a SSD it has firmware which could have been tampered with. It's not all that likely, but it's possible.
    – Daisetsu
    Oct 7, 2018 at 22:56
  • 3
    @Daisetsu It's very unlikely that an attacker who simply puts coin miners on a drive would also do something as highly sophisticated and stealthy as tamper with the firmware.
    – forest
    Oct 8, 2018 at 2:54
  • I totally agree, it's almost a 0% possibility, I meant to just add that it could happen. I should have phrased that better.
    – Daisetsu
    Oct 8, 2018 at 3:24
2

When we talk about Hard-drives, imagine a long row of shelves/drawers starting from left going all the way to your right. The first shelf on the left is labelled as 0x00 till 0xnn.

As you write files to the hard drive such a documents, pictures, etc these files are stored in block of shelves. When you delete a file, the file management system simply writes a "$" in front of the name of the file. The "$" prefix simply means that those shelves can now be re-used to write new data. The data or content is still occupying those shelves.

The reason I mentioned this is because, a lot of people think that by deleting files from a Hard drive means the disk is now empty. In reality, old files are still present on the drive and anybody with the right tools can retrieve them. In your case, it is quite possible that either this drive was a customer return and has been resold to you as a new, or somewhere in the logistics chain a malicious user has implanted a bit coin miner. I suspect the later.

I would return it.

3
  • If I reformat the hard drive would that overwrite any malicious files?
    – Newbbit
    Oct 9, 2018 at 22:29
  • 1
    @Newbbit Yes, formatting a hard drive will remove all files, malicious or not.
    – forest
    Oct 10, 2018 at 9:49
  • @Newbbit Yes it will but given you write 0s to all sectors of the hard drive. It depends what OS you are running. Any Unix based OS allows you to do this from "Disks" option. Here, you can select your drive and while formatting, choose an option along the lines of "Full format : write all zeros". If I were you, I would return it, but that's me being paranoid. Good luck ! Oct 10, 2018 at 22:15

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .