Troubleshoot Troubles with a flash drive

[TheMalwareMaster]

Good morning... Today I checked one of my flash drives I use for school and I noticed the entire AUTOCAD folder was corrupted. It was a folder with the .dwg and .bak files, but I only found inside it some files with names with strange carachters and extensions. It shouldn't be a worm, because my PC is not infected and there were no suspiscious files in it , but only those files with strange extensions that won't open. Only the AUTOCAD folder was corrupted, the other ones were read correctly. This isn't the first time it happens. In the past, all files in an other folder were corrupted. Then, I saved the other files and completely formatted it. After that, it was fine. I run scandisk on the flash drive, and the folder with the corrupted files disappeared and it was replaced with a blank file with no extension. It should be a problem of the disk, right? What should I do? It is TDK flash drive

 

[BoraMurdar]

• Checked for viruses ✔
• Checked for bad sectors and attempted recovery of the bad sectors ✔
• Extracted the important files to safe destination ✔
• Full format USB drive ✔
• Scan again against bad sectors
• Try changing the filename of the corrupted files to the correct one (for example DocumentA.docx is renamed to ahsdhgdaj.ttr , try rename the extension to correct one, and try to open it)
• If it fails, the data is corrupted
• If it happens again with no obvious reason, the USB stick is physically damaged

 

[TheMalwareMaster]

• Checked for viruses ✔
• Checked for bad sectors and attempted recovery of the bad sectors ✔
• Extracted the important files to safe destination ✔
• Full format USB drive ✔
• Scan again against bad sectors
• Try changing the filename of the corrupted files to the correct one (for example DocumentA.docx is renamed to ahsdhgdaj.ttr , try rename the extension to correct one, and try to open it)
• If it fails, the data is corrupted
• If it happens again with no obvious reason, the USB stick is physically damaged

Thank you. The problem is that, after running checkdisk, Windows has replaced the folder (AUTOCAD) with that black file, and the content obviously disappeared. So, I can't rename the files. That data wasn't important (I do no longer need those autocad files), and I can restore them because my autocad mate has a backup

 

[TheMalwareMaster]

I don't believe it's malware. Both times I discovered there was a folder with corrupted files in it, I was using a school PC. The school is running ESET NOD32 ANTIVIRUS with HDGUARD, a rollback software probably to prevent unwanted changes made by students (HDGUARD makes those computers really slow)
HDGUARD - Hard disk recovery, hdd protection and roll-back software (protect windows computer) . Each time the PC is switched off, HDGUARD goes back to the set snapshot, so any malware that may have been run, should have been removed. Today, I was using an other PC, that didn't have HDGUARD. I checked task manager, but that computer didn't appear to be infected. I believe my flash drive is physically damaged, so

 

[_CyberGhosT_]

Yeah I would get a couple new ones brother, they are so cheap now that it can't hurt and is a smart move to have a couple reserves.
And if the issue returns then, that is when I would alert the school or it's IT Dept..

 

[TheMalwareMaster]

Yeah I would get a couple new ones brother, they are so cheap now that it can't hurt and is a smart move to have a couple reserves.
And if the issue returns then, that is when I would alert the school or it's IT Dept..

Today I used the PC usually used by teachers, because we have to made a presentation on that one for our final exam. That one doesn't have HDGUARD, but didn't seem infected. But how can a PC, which is rolled back at a snapshot each time it's switched off be infected? (the ones with HDGUARD are for students)

 

[Winter Soldier]

The same story is happened to me with some job's files, but my USB stick was end-of-life (many read/write cycles).
The important thing is always having a backup of these files on your computer, external HDD, etc.

 

[TheMalwareMaster]

The same story is happened to me with some job's files, but my USB stick was end-of-life (many read/write cycles).
The important thing is always having a backup of these files on your computer, external HDD, etc.

The strange fact is that only a folder got corrupted

 

[Winter Soldier]

The strange fact is that only a folder got corrupted

Probably some specific sectors where the files of that folder were stored, were damaged.

 

[_CyberGhosT_]

Today I used the PC usually used by teachers, because we have to made a presentation on that one for our final exam. That one doesn't have HDGUARD, but didn't seem infected. But how can a PC, which is rolled back at a snapshot each time it's switched off be infected? (the ones with HDGUARD are for students)

It may not be infection, but to address this, the HD is not the only place an infection will lay dormant and reinfect, think on that
you know this.
I bet like the others are hinting at though that it may be that the USB had errors, it's not as uncommon as you might think. A bad sector can effect only certain areas, hence sometimes only certain files.

 

[TheMalwareMaster]

It may not be infection, but to address this, the HD is not the only place an infection will lay dormant and reinfect, think on that
you know this.
I bet like the others are hinting at though that it may be that the USB had errors, it's not as uncommon as you might think. A bad sector can effect only certain areas, hence sometimes only certain files.

Thank you. I'll see if the problem comes again in some time.

 

[_CyberGhosT_]

Thank you. I'll see if the problem comes again in some time.

No worries brother, keep us informed

 

[TheMalwareMaster]

No worries brother, keep us informed

I don't believe it's an infection, anyway. I checked task manager while inserting the flash drive with the corrupted files in my home pc and no new processes were created. Do you think that the school network can be infected?

 

[frogboy]

Just to be sure maybe you could give this a try. UsbFix : Free USB Anti-Malware

Hope you can get it sorted.

 

[Winter Soldier]

Do you think that the school network can be infected?

I don't know your case but...I remember my school computer was a den of snakes !!

 

[_CyberGhosT_]

I don't believe it's an infection, anyway. I checked task manager while inserting the flash drive with the corrupted files in my home pc and no new processes were created. Do you think that the school network can be infected?

Just based on our discussion here, it would be inappropriate for me to say, and unfair to the school.
Having said that, you know the saying about idle hands, as well as the curious mindset with most students,
so it would be safe brother to assume "yes" it most likely is. And proceed accordingly PeAcE