Scheduled Maintenance: We are aware of an issue with Google, AOL, and Yahoo services as email providers which are blocking new registrations. We are trying to fix the issue and we have several internal and external support tickets in process to resolve the issue. Please see: viewtopic.php?t=158230

 

 

 

strange behavior of Cruzer SanDisk USB flash drive

Off-Topic discussions about science, technology, and non Debian specific topics.
Post Reply
Message
Author
User avatar
EMD
Posts: 983
Joined: 2007-06-10 03:03
Location: /dev/tty7 (Don't deny it. You're here too!)

strange behavior of Cruzer SanDisk USB flash drive

#1 Post by EMD »

Has anyone else experienced the strange behavior of Cruzer SanDisk USB flash drives?

I recently reformatted one (using fdisk and mkfs.vfat), saved some files to it and inserted it in my wife's computer (which runs MS Windows XP). When I opened the drive, I noticed that it suddenly had a "Documents" folder (with four empty subfolders) and a "LaunchU3.exe" file.

Where did these files come from? I reformatted the disk! How did MS Windows know that it was a Cruzer SanDisk?

The strange behavior didn't end there however. After I reinserted the disk in my own computer (which only runs Debian), I noticed another folder called "System" with a subfolder called "Apps" that contains two files: "LPDB.xml" and "LPGDB.xml."

Here's the code from the "LPGDB.xml" file:

Code: Select all

<LPGDB>
	<DONOTSHOW></DONOTSHOW><RUNNINGTIME></RUNNINGTIME><PROGRAMS></PROGRAMS><DONOTSOUND></DONOTSOUND>
	<DEVICELABEL>USB</DEVICELABEL><DEVICElABELFLAG>0</DEVICElABELFLAG><UpdatesAutoCheck>1</UpdatesAutoCheck><LastAutoCheckTime>1197039958</LastAutoCheckTime></LPGDB>
and here's the code from the "LPDB.xml" file:

Code: Select all

<LPDB/>
What's up with "DO NOT SHOW" and "UpdatesAutoCheck" ???
.

@johan
Posts: 179
Joined: 2007-04-23 20:13
Location: Europe, The Netherlands.

#2 Post by @johan »

Malware according to Google :lol:

User avatar
EMD
Posts: 983
Joined: 2007-06-10 03:03
Location: /dev/tty7 (Don't deny it. You're here too!)

#3 Post by EMD »

Apparently SanDisk installed its malware on my wife's MS Windows computer when she inserted her Cruzer SanDisk USB flash drive into her computer. Then when I inserted my Cruzer SanDisk USB flash drive into her computer, MS Windows recognized it as another Cruzer SanDisk USB flash drive and restored the software that I had deleted.

A CNET user had a similar experience and wrote this review:
CNET user wrote:fine flash drive, cap doesn't get lost.
however the "U3 pimping software" is adware plain and simple. Actually I'd consider it Malware, since it installs with absolutely NO USER INTERACTION.
1. I insert flash drive
2. I see U3 Launchpad wanting me to install Skype, and whatever the antivirus software was that they were trying to pimp out.
3. format F: (USB Drive)
4. remove the empty flash drive.
5. reinstall flash drive
6. U3 software launches again and reinstalls itself on the flash drive.

The only way to get out of it is to either:
A. hold down shift key the FIRST time you ever use the flash drive (so software doesn't autorun)
B. Find the "U3 Removal tool" thats on Sandisks web site if you can find it.
http://www.sandisk.com/Retail/Default.aspx?CatID=1415

As an experiment I inserted drive on computer A. U3 installed itself, then I inserted same flash drive in Computer B, but held down shift key so no autorun kicked in. Then I formated drive and removed it.
reinserted in Computer B and drive is free and clear(no software on it). Then moved same flash drive back to computer A and boom...software is back on the flash drive again. This means they installed software on my windows system without me ever agreeing to any sort of license agreement. Wouldn't that be considered Malware??????

User avatar
Noven
Posts: 241
Joined: 2007-03-18 02:11

#4 Post by Noven »

thats why on my memory sticks I use ext2/3 =)

joe sixpak
Posts: 1
Joined: 2012-02-01 05:03

Re: strange behavior of Cruzer SanDisk USB flash drive

#5 Post by joe sixpak »

u3 is just crapware
many usb disks/flash have it

totally worthless for users

usually they have a protected area of your memory they use for it
some devices can be scrubbed some cant

many vendors have stopped using it cause users dont want it
do not worry about it
it is just an annoyance not a threat

read more at wikipedia
U3 was a joint venture between SanDisk and M-Systems [1], producing a proprietary method of launching Windows applications from special USB flash drives. Flash drives adhering to the U3 specification are termed "U3 smart drives". U3 smart drives come preinstalled with the U3 Launchpad, which looks similar to the Windows OS start menu and controls program installation. Applications that comply with U3 specifications are allowed to write files or registry information to the host computer, but they must remove this information when the flash drive is ejected. Customizations and settings are instead stored with the application on the flash drive.

Microsoft and SanDisk created a successor called StartKey.

SanDisk began phasing out support for U3 Technology in late 2009.[2]

vbrummond
Posts: 4432
Joined: 2010-03-02 01:42

Re: strange behavior of Cruzer SanDisk USB flash drive

#6 Post by vbrummond »

I successfully compiled this program under Debian to remove the u3 partition. I can not remember how I did it (well compiling was easy) though but I know it worked.
http://u3-tool.sourceforge.net/

Because the u3 partition kept kernel oopsing my 3.0 kernel is why I removed it. Was annoying to get dropped to tty1 every time I plugged it in. Have to manually go back to tty7 :D
Always on Debian Testing

Post Reply