Page 1 of 1

strange behavior of Cruzer SanDisk USB flash drive

Posted: 2007-12-07 15:35
by EMD
Has anyone else experienced the strange behavior of Cruzer SanDisk USB flash drives?

I recently reformatted one (using fdisk and mkfs.vfat), saved some files to it and inserted it in my wife's computer (which runs MS Windows XP). When I opened the drive, I noticed that it suddenly had a "Documents" folder (with four empty subfolders) and a "LaunchU3.exe" file.

Where did these files come from? I reformatted the disk! How did MS Windows know that it was a Cruzer SanDisk?

The strange behavior didn't end there however. After I reinserted the disk in my own computer (which only runs Debian), I noticed another folder called "System" with a subfolder called "Apps" that contains two files: "LPDB.xml" and "LPGDB.xml."

Here's the code from the "LPGDB.xml" file:

Code: Select all

<LPGDB>
	<DONOTSHOW></DONOTSHOW><RUNNINGTIME></RUNNINGTIME><PROGRAMS></PROGRAMS><DONOTSOUND></DONOTSOUND>
	<DEVICELABEL>USB</DEVICELABEL><DEVICElABELFLAG>0</DEVICElABELFLAG><UpdatesAutoCheck>1</UpdatesAutoCheck><LastAutoCheckTime>1197039958</LastAutoCheckTime></LPGDB>
and here's the code from the "LPDB.xml" file:

Code: Select all

<LPDB/>
What's up with "DO NOT SHOW" and "UpdatesAutoCheck" ???
.

Posted: 2007-12-07 15:54
by @johan
Malware according to Google :lol:

Posted: 2007-12-07 22:40
by EMD
Apparently SanDisk installed its malware on my wife's MS Windows computer when she inserted her Cruzer SanDisk USB flash drive into her computer. Then when I inserted my Cruzer SanDisk USB flash drive into her computer, MS Windows recognized it as another Cruzer SanDisk USB flash drive and restored the software that I had deleted.

A CNET user had a similar experience and wrote this review:
CNET user wrote:fine flash drive, cap doesn't get lost.
however the "U3 pimping software" is adware plain and simple. Actually I'd consider it Malware, since it installs with absolutely NO USER INTERACTION.
1. I insert flash drive
2. I see U3 Launchpad wanting me to install Skype, and whatever the antivirus software was that they were trying to pimp out.
3. format F: (USB Drive)
4. remove the empty flash drive.
5. reinstall flash drive
6. U3 software launches again and reinstalls itself on the flash drive.

The only way to get out of it is to either:
A. hold down shift key the FIRST time you ever use the flash drive (so software doesn't autorun)
B. Find the "U3 Removal tool" thats on Sandisks web site if you can find it.
http://www.sandisk.com/Retail/Default.aspx?CatID=1415

As an experiment I inserted drive on computer A. U3 installed itself, then I inserted same flash drive in Computer B, but held down shift key so no autorun kicked in. Then I formated drive and removed it.
reinserted in Computer B and drive is free and clear(no software on it). Then moved same flash drive back to computer A and boom...software is back on the flash drive again. This means they installed software on my windows system without me ever agreeing to any sort of license agreement. Wouldn't that be considered Malware??????

Posted: 2007-12-08 02:36
by Noven
thats why on my memory sticks I use ext2/3 =)

Re: strange behavior of Cruzer SanDisk USB flash drive

Posted: 2012-02-01 05:08
by joe sixpak
u3 is just crapware
many usb disks/flash have it

totally worthless for users

usually they have a protected area of your memory they use for it
some devices can be scrubbed some cant

many vendors have stopped using it cause users dont want it
do not worry about it
it is just an annoyance not a threat

read more at wikipedia
U3 was a joint venture between SanDisk and M-Systems [1], producing a proprietary method of launching Windows applications from special USB flash drives. Flash drives adhering to the U3 specification are termed "U3 smart drives". U3 smart drives come preinstalled with the U3 Launchpad, which looks similar to the Windows OS start menu and controls program installation. Applications that comply with U3 specifications are allowed to write files or registry information to the host computer, but they must remove this information when the flash drive is ejected. Customizations and settings are instead stored with the application on the flash drive.

Microsoft and SanDisk created a successor called StartKey.

SanDisk began phasing out support for U3 Technology in late 2009.[2]

Re: strange behavior of Cruzer SanDisk USB flash drive

Posted: 2012-02-01 06:50
by vbrummond
I successfully compiled this program under Debian to remove the u3 partition. I can not remember how I did it (well compiling was easy) though but I know it worked.
http://u3-tool.sourceforge.net/

Because the u3 partition kept kernel oopsing my 3.0 kernel is why I removed it. Was annoying to get dropped to tty1 every time I plugged it in. Have to manually go back to tty7 :D