Troubleshoot Troubles with a flash drive

TheMalwareMaster

TheMalwareMaster

Level 21
Thread author
Verified
Honorary Member
Top Poster
Well-known
Forum Veteran
Jan 4, 2016
1,065
5,725
1,978
Europe
Good morning... Today I checked one of my flash drives I use for school and I noticed the entire AUTOCAD folder was corrupted. It was a folder with the .dwg and .bak files, but I only found inside it some files with names with strange carachters and extensions. It shouldn't be a worm, because my PC is not infected and there were no suspiscious files in it , but only those files with strange extensions that won't open. Only the AUTOCAD folder was corrupted, the other ones were read correctly. This isn't the first time it happens. In the past, all files in an other folder were corrupted. Then, I saved the other files and completely formatted it. After that, it was fine. I run scandisk on the flash drive, and the folder with the corrupted files disappeared and it was replaced with a blank file with no extension. It should be a problem of the disk, right? What should I do? It is TDK flash drive
autocad.PNG tdk.jpg
 
  • Like
Reactions: brambedkar59 and _CyberGhosT_
Sort by date Sort by votes
  • Checked for viruses ✔
  • Checked for bad sectors and attempted recovery of the bad sectors ✔
  • Extracted the important files to safe destination ✔
  • Full format USB drive ✔
  • Scan again against bad sectors
  • Try changing the filename of the corrupted files to the correct one (for example DocumentA.docx is renamed to ahsdhgdaj.ttr , try rename the extension to correct one, and try to open it)
  • If it fails, the data is corrupted
  • If it happens again with no obvious reason, the USB stick is physically damaged
 
  • Like
Reactions: brambedkar59, Vasudev, Parsh and 6 others
Upvote 0
BoraMurdar said:
  • Checked for viruses ✔
  • Checked for bad sectors and attempted recovery of the bad sectors ✔
  • Extracted the important files to safe destination ✔
  • Full format USB drive ✔
  • Scan again against bad sectors
  • Try changing the filename of the corrupted files to the correct one (for example DocumentA.docx is renamed to ahsdhgdaj.ttr , try rename the extension to correct one, and try to open it)
  • If it fails, the data is corrupted
  • If it happens again with no obvious reason, the USB stick is physically damaged
Click to expand...
Thank you. The problem is that, after running checkdisk, Windows has replaced the folder (AUTOCAD) with that black file, and the content obviously disappeared. So, I can't rename the files. That data wasn't important (I do no longer need those autocad files), and I can restore them because my autocad mate has a backup
 
  • Like
Reactions: brambedkar59, frogboy and BoraMurdar
Upvote 0
I don't believe it's malware. Both times I discovered there was a folder with corrupted files in it, I was using a school PC. The school is running ESET NOD32 ANTIVIRUS with HDGUARD, a rollback software probably to prevent unwanted changes made by students (HDGUARD makes those computers really slow)
HDGUARD - Hard disk recovery, hdd protection and roll-back software (protect windows computer) . Each time the PC is switched off, HDGUARD goes back to the set snapshot, so any malware that may have been run, should have been removed. Today, I was using an other PC, that didn't have HDGUARD. I checked task manager, but that computer didn't appear to be infected. I believe my flash drive is physically damaged, so
 
  • Like
Reactions: brambedkar59, BugCode, Winter Soldier and 1 other person
Upvote 0
_CyberGhosT_ said:
Yeah I would get a couple new ones brother, they are so cheap now that it can't hurt and is a smart move to have a couple reserves.
And if the issue returns then, that is when I would alert the school or it's IT Dept..
Click to expand...
Today I used the PC usually used by teachers, because we have to made a presentation on that one for our final exam. That one doesn't have HDGUARD, but didn't seem infected. But how can a PC, which is rolled back at a snapshot each time it's switched off be infected? (the ones with HDGUARD are for students)
 
  • Like
Reactions: _CyberGhosT_
Upvote 0
Winter Soldier said:
The same story is happened to me with some job's files, but my USB stick was end-of-life (many read/write cycles).
The important thing is always having a backup of these files on your computer, external HDD, etc.
Click to expand...
The strange fact is that only a folder got corrupted
 
  • Like
Reactions: _CyberGhosT_, frogboy and Winter Soldier
Upvote 0
TheMalwareMaster said:
Today I used the PC usually used by teachers, because we have to made a presentation on that one for our final exam. That one doesn't have HDGUARD, but didn't seem infected. But how can a PC, which is rolled back at a snapshot each time it's switched off be infected? (the ones with HDGUARD are for students)
Click to expand...
It may not be infection, but to address this, the HD is not the only place an infection will lay dormant and reinfect, think on that
you know this.
I bet like the others are hinting at though that it may be that the USB had errors, it's not as uncommon as you might think. A bad sector can effect only certain areas, hence sometimes only certain files.
 
  • Like
Reactions: brambedkar59, Parsh, frogboy and 2 others
Upvote 0
_CyberGhosT_ said:
It may not be infection, but to address this, the HD is not the only place an infection will lay dormant and reinfect, think on that
you know this.
I bet like the others are hinting at though that it may be that the USB had errors, it's not as uncommon as you might think. A bad sector can effect only certain areas, hence sometimes only certain files.
Click to expand...
Thank you. I'll see if the problem comes again in some time.
 
  • Like
Reactions: Winter Soldier, frogboy and _CyberGhosT_
Upvote 0
_CyberGhosT_ said:
No worries brother, keep us informed ;)
Click to expand...
I don't believe it's an infection, anyway. I checked task manager while inserting the flash drive with the corrupted files in my home pc and no new processes were created. Do you think that the school network can be infected?
 
  • Like
Reactions: _CyberGhosT_, Winter Soldier and frogboy
Upvote 0
TheMalwareMaster said:
I don't believe it's an infection, anyway. I checked task manager while inserting the flash drive with the corrupted files in my home pc and no new processes were created. Do you think that the school network can be infected?
Click to expand...
Just based on our discussion here, it would be inappropriate for me to say, and unfair to the school.
Having said that, you know the saying about idle hands, as well as the curious mindset with most students,
so it would be safe brother to assume "yes" it most likely is. And proceed accordingly ;) PeAcE
 
  • Like
Reactions: TheMalwareMaster, Winter Soldier and frogboy
Upvote 0

You may also like...