Not too sure, but SD card content caused malware?

erique82 · May 24, 2010

Hi folks, a friend of mine transferred his camera pictures onto my laptop via the card reader. Usually it works with mine (SD card) but when he pops his SD card in, all I've got is just two shortcut folders DCIM and FRAME. You get nothing when you double click on them. The folder is linked to C:\windows\system32. But when you put the card back in the camera, the pictures are all there! I've scanned it with avg antivirus and no virus / trojan is found.

Then the problem start. My task manager gets disabled and firefox keeps closing itself when connected to the internet. Thankfully I managed to download Malwarebytes anti malware and get the nasty bugs removed. After complete scanning and removal on the laptop, I've inserted the supposedly infected card and get it scanned as well. Surprisingly nothing is detected... what the heck?

Now what I'm curious is... where did i get all this malware? i haven't download anything the past few days or visit any websites other than facebook and gmail. Now I've inserted my OWN SD card into the laptop card reader and the shortcut appears again... without my pictures. It's not like the pictures are gone, but I can't access the real DCIM folder to get them transferred. Very confusing indeed. :confused

Kestrel13! · May 24, 2010

Welcome to Major Geeks!

Please read ALL of this message including the notes before doing anything.

Pleases follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide

and attach the requested logs when you finish these instructions.

**** If something does not run, write down the info to explain to us later but keep on going. ****

Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.

To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

erique82 · May 24, 2010

Ok, I finally managed to get things right, but it was rather tricky. This ishow I dealt with it.

I ran my system in normal mode. The bugs made it tough for me to download anti malware or anything in particular. Every time i click on the download link, firefox will prompt me to close. I cheated my way, by right clicking (gotta have quick fingers) the download link and open it in a new tab. Somewhow managed to download SDFix, Malwarebytes anti-malware and Hijackthis.

After download, the computer won't let me install any program so I had to run all application in Safe Mode. I tried SDFix but it wasn't much of a help. Nothing gets sorted. Then I tried Hijackthis, but as you know, it just helps getting a log file and with the trouble of connecting to the internet again, I decided to run Malwarebytes.

Finally, I get all the hidden malwares cleaned. Thank God! Now I can get back to running XP normally, I downloaded, updated and install Superantispyware which you guys recommended. It manages to find other remaining malware and get that cleaned too. :-D

I then scanned my SD card, only Superantisypware found the hidden malware and cleaned it. But even after cleaning I can't see and copy my pictures.

To address that problem of mine where I can't get my pictures, I tried viewing hidden files and folders. Nope, still can't get any pictures. Then I used ACD (imaging software) which somehow managed to browse the pictures in the SD card. I copied all the pictures onto my desktop and reformat the SD card and voila! problem solved. I copied the pictures back onto the card and I can view them normally. :-D

Apparently the malware or whatever set my SD card to FAT instead of FAT32. Now I don't know much what that really means, but when I quick format it to FAT32, I get my icons back and I can use my card the way it used to. :cool

Kestrel13! · May 24, 2010

Well if you have any further troubles I will have you run the COMPLETE R&R to check for remnants. Otherwise...safe surfing.

Log in or Sign up

Not too sure, but SD card content caused malware?

erique82 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

erique82 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member