USB with partition that runs .exe program. - How to remove it

Question

I have receive a USB, but I noticed that as soon as I connected it to my computer, a video of an organization is shown.

Its like an informative video, it makes me think about nothing dangerous.

But...

I noticed that the USB has 2 partitions, one is recognized as a CD ROM and the other is just a normal USB partition.

Once, I realized that I opened the CD Drive and I noticed that it has a very innocent looking video file, after that I enabled the option to view hidden files and just as I was expecting, I saw two hidden files.

I received the USB a long time ago, I saw this before, so in the past I was able to change the video name, so I won't show it in the screenshot because the name of the video is not very respectful.

In the past, I thought that I had removed the partition (don't remember what I did), but now as I am planning to use this USB, I noticed that it is still there.

My main goal here is to remove that partition because I already checked the files on virustotal and they got detected.

[autorun]
open=laucher.exe        
icon=          
file0 = ******************.mov  // I changed the file name for asterisks
file1 =
file2 =  
url0 = 
url1 = 
url2 = 
url3 = 
url4 = 

I think that I can disable the "thing" by changing the code in autorun.inf to not open the launcher.exe

But files are protected

Of course I tried to change the permissions of the files but I got this message:

Yes, I tried to click continue but that just shows a new message:

My main concern is: How do I remove that partition? But also I'd like to know what can happen to the devices that I've connected this USB to, what can I do to remove or revert any configurations changed by the .exe, how do I know if Im infected with something?

Of course Im scanning my device with multiple software but I'd like to make sure by asking to the experts (you).

Thanks in advance.

Answer 1

First things first: there's no guarantee that the USB device is malicious. What's more, if it is, it's probably too late already; you've plugged it in and its EXE has run. However, it's still worth thinking about whether you want to take some precautions with it (such as not connecting it to other devices).

Unless you're able to reprogram the device, I certainly wouldn't recommend using it as a general-purpose flashdrive. If you are able to reprogram it, well, there's a lot of cool stuff you could do with that but I guess you could use it as a flashdrive worth (generously) one fifth as much as the actual value of that neatly packaged reprogrammable USB microcontroller.

---

This is actually a really clever technique: the USB device is not a simple flashdrive (a USB Mass Storage device presenting a block device), but is probably actually a disguised USB Hub (you can verify this in Device Manager) that presents two child devices: a USB Mass Storage device (the F: drive) and a (virtual) USB CD-ROM device (the E: drive).

Windows has, ever since Vista (maybe even XP SP3), not auto-run code from flashdrives by default. However, it might still be possible to autorun from optical drives (I can't remember; when was the last time you used an actual data CD-ROM in a PC?). Thus, if you want code to autorun, you might choose to do it this way, with a virtual CD-ROM drive containing a virtual CD-ROM that the PC thinks is a real one, and thus thinks it can autorun code from it.

A few notes about this:

• You won't be able to delete the CD-ROM partition, because it's not an actual partition on any block device. As far as Windows is concerned, it's a completely different disk.
• You won't be able to edit or delete files on the "CD-ROM", at least not directly, because as far as Windows knows, it's a CD-ROM (hint: the "ROM" stands for "Read-Only Memory"). That's not a permissions issue; it's Windows saying "hey, this device is physically not writable with this hardware".
• You also can't (permanently) remove the CD-ROM device, because again, it's a completely different device (as far as Windows knows) from the flashdrive or USB hub that are exposed to the OS, but in reality it's all part of the same virtual USB hub. You can unplug the USB device but everything "connected to it" will still be there when you plug it in again.
• There might well be more virtual (or real!) devices hanging off that USB hub than you realize! There could be a virtual keyboard (for entering arbitrary keystrokes), a virtual network device (for trying to fool your PC into routing network traffic through the device), an actual WiFi device (for connecting the USB stick to the Internet when your PC tells it the credentials for your WiFi), or so on. You can probably find any such things in Device Manager too. Use the "view devices by connection" layout.
• You might be able to (virtually) disconnect the CD-ROM drive (using Safely Remove Hardware), or "eject" the CD through Explorer or another tool, though that will only work after you've already connected the device and also might not actually work at all depending on how sophisticated the virtual device is.
• It's possible that you don't actually have 8GB of storage on the flashdrive portion of the device. Hardware can report whatever size it wants, with no guarantee that all of those addresses actually map to distinct physical storage (or indeed to any storage at all). On the other hand, it's possible that you do; 8GB is a nice believable size for a flashdrive while still being incredibly cheap as far as the amount of storage itself costs. In fact, the device quite likely has more than 8GB of storage on it, it needs somewhere to store both the code that implements the virtual CD-ROM drive, and the data on the virtual CD-ROM itself.
• You might be able to reprogram the USB device. Usually, the more sophisticated sort of USB devices - such as the ones that can fake being multiple different devices - are programmable so that their owner / the attacker can make them do different things. However, they may need to be interacted with in a particular way (over the USB interface, or physically via a hidden button or similar) to put them in programmable mode (in which mode they'll likely present an entirely different kind of device, a microcontroller with some storage).

Answer 2

What you are dealing with is a U3 device. It's set up to be two devices, one of which is a CD emulation.

It uses the CD auto-run capability to accomplish it's self start.

First off, disable CD Auto-run on your Windows machine! This should have been disabled for some time now by default but apparently you have it on.

Take the U3 thumb drive, place it in a Linux machine and DD a few meg of zeros to the beginning of the device. This should remove all the header structures. After the DD, format the device normally and you should be good to go.

Answer 3

If it is a U3 drive, then SanDisk has a CD-partition removal utility here.

SD cards and some USB devices can be cleared with another tool.

Otherwise, Windows 10 is not really reliable for USB partition management (the recommended recipe using DiskMgmt, here, sometimes does not work), so I suspect your best option would be a live GParted disk.