strange behavior of Cruzer SanDisk USB flash drive

If it doesn't relate to Debian, but you still want to share it, please do it here

strange behavior of Cruzer SanDisk USB flash drive

Postby EMD » 2007-12-07 15:35

Has anyone else experienced the strange behavior of Cruzer SanDisk USB flash drives?

I recently reformatted one (using fdisk and mkfs.vfat), saved some files to it and inserted it in my wife's computer (which runs MS Windows XP). When I opened the drive, I noticed that it suddenly had a "Documents" folder (with four empty subfolders) and a "LaunchU3.exe" file.

Where did these files come from? I reformatted the disk! How did MS Windows know that it was a Cruzer SanDisk?

The strange behavior didn't end there however. After I reinserted the disk in my own computer (which only runs Debian), I noticed another folder called "System" with a subfolder called "Apps" that contains two files: "LPDB.xml" and "LPGDB.xml."

Here's the code from the "LPGDB.xml" file:
Code: Select all

and here's the code from the "LPDB.xml" file:
Code: Select all

What's up with "DO NOT SHOW" and "UpdatesAutoCheck" ???
User avatar
Posts: 989
Joined: 2007-06-10 03:03
Location: /dev/tty7 (Don't deny it. You're here too!)

Postby @johan » 2007-12-07 15:54

Malware according to Google :lol:
Posts: 180
Joined: 2007-04-23 20:13
Location: Europe, The Netherlands.

Postby EMD » 2007-12-07 22:40

Apparently SanDisk installed its malware on my wife's MS Windows computer when she inserted her Cruzer SanDisk USB flash drive into her computer. Then when I inserted my Cruzer SanDisk USB flash drive into her computer, MS Windows recognized it as another Cruzer SanDisk USB flash drive and restored the software that I had deleted.

A CNET user had a similar experience and wrote this review:

CNET user wrote:fine flash drive, cap doesn't get lost.
however the "U3 pimping software" is adware plain and simple. Actually I'd consider it Malware, since it installs with absolutely NO USER INTERACTION.
1. I insert flash drive
2. I see U3 Launchpad wanting me to install Skype, and whatever the antivirus software was that they were trying to pimp out.
3. format F: (USB Drive)
4. remove the empty flash drive.
5. reinstall flash drive
6. U3 software launches again and reinstalls itself on the flash drive.

The only way to get out of it is to either:
A. hold down shift key the FIRST time you ever use the flash drive (so software doesn't autorun)
B. Find the "U3 Removal tool" thats on Sandisks web site if you can find it.

As an experiment I inserted drive on computer A. U3 installed itself, then I inserted same flash drive in Computer B, but held down shift key so no autorun kicked in. Then I formated drive and removed it.
reinserted in Computer B and drive is free and clear(no software on it). Then moved same flash drive back to computer A and is back on the flash drive again. This means they installed software on my windows system without me ever agreeing to any sort of license agreement. Wouldn't that be considered Malware??????
User avatar
Posts: 989
Joined: 2007-06-10 03:03
Location: /dev/tty7 (Don't deny it. You're here too!)

Postby Noven » 2007-12-08 02:36

thats why on my memory sticks I use ext2/3 =)
User avatar
Posts: 242
Joined: 2007-03-18 02:11

Re: strange behavior of Cruzer SanDisk USB flash drive

Postby joe sixpak » 2012-02-01 05:08

u3 is just crapware
many usb disks/flash have it

totally worthless for users

usually they have a protected area of your memory they use for it
some devices can be scrubbed some cant

many vendors have stopped using it cause users dont want it
do not worry about it
it is just an annoyance not a threat

read more at wikipedia
U3 was a joint venture between SanDisk and M-Systems [1], producing a proprietary method of launching Windows applications from special USB flash drives. Flash drives adhering to the U3 specification are termed "U3 smart drives". U3 smart drives come preinstalled with the U3 Launchpad, which looks similar to the Windows OS start menu and controls program installation. Applications that comply with U3 specifications are allowed to write files or registry information to the host computer, but they must remove this information when the flash drive is ejected. Customizations and settings are instead stored with the application on the flash drive.

Microsoft and SanDisk created a successor called StartKey.

SanDisk began phasing out support for U3 Technology in late 2009.[2]
joe sixpak
Posts: 1
Joined: 2012-02-01 05:03

Re: strange behavior of Cruzer SanDisk USB flash drive

Postby vbrummond » 2012-02-01 06:50

I successfully compiled this program under Debian to remove the u3 partition. I can not remember how I did it (well compiling was easy) though but I know it worked.

Because the u3 partition kept kernel oopsing my 3.0 kernel is why I removed it. Was annoying to get dropped to tty1 every time I plugged it in. Have to manually go back to tty7 :D
System: Retina 5K iMac, 27-inch, Late 2015 - Intel i5-6600 3.3ghz, 8gb RAM, AMD Radeon R9 M395 2048 MB
OS: Mac OS 10.12
Posts: 4417
Joined: 2010-03-02 01:42

Return to Offtopic

Who is online

Users browsing this forum: No registered users and 3 guests