Changes

Sandisk U3 Flash Drive Virus

3,482 bytes added, 18:43, 31 March 2016
The following lines were added (+) and removed (-):
U3 is a USB flash storage app that lets you carry and run Microsoft Windows applications directly from the flash drive. For some people, this is a useful tool. However, it is also an extremely invasive piece of software that automatically installs itself on a Windows PC without asking permission or providing the option not to install as soon as you plug in the USB flash drive.U3 is a USB flash storage application that lets you carry and run Microsoft Windows applications directly from the flash drive. For some people, this is a useful tool. However, it is also an extremely invasive piece of software that automatically installs itself on a Windows PC without asking permission or providing the option not to install as soon as you plug in the USB flash drive.All USB Flash Drives that support the new U3 standard have a locked, non-deletable, 2nd drive emulating a CD-ROM drive which is setup to auto-install the U3 software on any windows PC you plug the Flash Drive into. If you don't disable [[autorun]], or hold down the shift key anytime you plug one of these drives into someone's Windows, this malware is automatically installed.  It will even prompt the user to reboot windows XP after the install is complete.  But it will not prompt the user prior to installing the malware.* U3 Launchpad uses the autorun.inf file on the thumbdrive root.  The U3 program is stored on a special read-only partition of the thumbdrive and cannot be manually removed by simply formatting or deleting.Hold down the <big><big><big>'''SHIFT KEY'''</big></big></big> when inserting a thumbdrive to prevent autorun.inf from launching and installing U3.* '''Installs software without permission:''' When you plug in the drive, it uses a hack to take advantage of the CD-ROM [[autorun]] vulnerability to install U3 software without your permission.  * When SanDisk first released their Cruzer drives with U3 technology, they did NOT include an uninstall utility.* Under pressure from support callers, SanDisk provided an uninstall utility on their web site* SanDisk started to include the uninstall utility on newer Cruzer drives, however, U3 will still auto-install.* The uninstall utility does not do a 100% removal and restoration, orphaned files remain and alterations to the windows registry.old-style floppy virus.  Disabling U3 autorun is by disabling CD autorunold-style floppy virus.  Disabling U3 [[autorun]] is by disabling CD autorunvia the registry - http://support.microsoft.com/?id=155217 A quickvia the registry - <del>http://support.microsoft.com/?id=155217</del>* A quick''*. You cannot count of Micro$oft maintaining a link location.''1) Download the U3 software: [http://www.sandisk.com/Retail/Default.aspx?CatID=1415 U3 Launchpad Removal Tool]  # Download the U3 software: [http://www.sandisk.com/Retail/Default.aspx?CatID=1415 U3 Launchpad Removal Tool]  2) Remove any files that you have loaded and want to retain.# Remove any files that you have loaded and want to retain.3) Plug in your SanDisk drive.# Plug in your SanDisk drive.4) Run the U3 tool that you downloaded in step 1.# Run the U3 tool that you downloaded in step 1.5) If the above does not work you might try this: http://www.u3.com/uninstall/default.aspx# If the above does not work you might try this: http://www.u3.com/uninstall/default.aspx U3 will add the following to your PC: # A hidden folder: C:\Documents and Settings\<username>\Application Data\U3\temp More on U3: http://www.hoystory.com/?p=3864'''More on U3''':  * http://www.hoystory.com/?p=3864* [http://techrepublic.com.com/5208-11183-0.html?forumID=5&threadID=187062&start=0 Disable U3 on flash drive]* [http://sublimesoftware.blogspot.com/2006/10/u3-usb-drive.html?showComment=1164664620000 U3 USB drive]=== Prevent Installation ===Take your new Sandisk Cruzer flash drive back to the retailer where you purchased it and demand a refund.  Yet, if you still wish to use this product from a sleezy company, here is how to format it without the U3 virus infecting your system.# Hold down the SHIFT key and insert the flash drive.  Keep holding down SHIFT# Once the flash drive is recognized you may release the SHIFT key# goto My Computer and format the flash drive with FAT32Holding down the shift key will prevent autorun from launching the U3 malware.  Formatting the new flash drive will get rid of the U3 malware so that you may use it as a normal flash drive in the future.  Defeat the auto-install by keeping the shift key held down when you plug in the drive.&nbsp;The Secure II Plus software will not auto install like U3 ('''unverified''') as most of this type of encryption software bundled with some flash drives tends not to auto-install.  The only known bundled flash drive software that auto-installs like a virus is the U3 software included with new SanDisk brand flash drives.  == Related == * [[Autorun|Autoplay, Autorun, and Auto-insert notification]]* [[Turn off Autoplay With Group Policy Editor]]* [[Sandisk U3 Flash Drive Virus]]* [[Sony DRM Rootkit]] For Linux Users:* [[How_Do_I:_A_Linux_Q%26A#.5BDISABLE_ANNOYING_KDE_Autorun_WHEN_CDROM_IS_IN_DRIVE_WHEN_KDE_STARTS.5D|KDE Autorun]][[Category:Hardware]]<small><small>keywords: usb flash virus drive thumb stick memory security</small></small>
Bureaucrat, administrator
16,192
edits