Oh no, I've been infected by a virus again!!

Edit: typo fixes

Yesterday, I needed to get a monochromatic ID picture printed to photographic paper and while at it, I also needed to print a page of text. I've visited a nearby mall in the morning for this reason.

To my surprise, they had decent automated kiosks just for this purpose at the photo specialty store. Naturally, none of them could read my flash key drive, even after asking for assistance from the pretty lady at the counter. She said this does happen sometimes. Thankfully everything went fine after manually selecting the image at her computer, as the drive was read in a second there. Probably too many files on the drive for the bogous software to cope with. Anyway, the whole process about five to ten minutes.

After that, I went to the normal printing booth for my other task. The guy was busy on the phone for about five minutes while he was acting as if he was refilling paper. After hanging up, he asked for the place where he could find the items to print. I quickly provided the answer, though I was a bit puzzled, as I always prepare the drive to a ridiculously plain form before these occasions at home.

I'll list the contents of the drive:
drwxr-xr-x 8 10335 11070    8192 szept  1 04.32 __
drwxr-xr-x 2 10335 11070 8192 szept 1 09.29 foto
drwxr-xr-x 3 10335 11070 8192 szept 1 04.34 nyomtat


For the curious: "foto" means "photo" and "nyomtat" means "to print" in Hungarian, and the underscore directory stores my data not relevant to the task at hand. Can you make it any simpler than that?

Everything went all fine, until I checked my drive that evening. It gave the following listing:
drwxr-xr-x 8 10335 11070    8192 szept  1 04.32 __
-r-xr-xr-x 1 10335 11070 148 szept 1 11.06 autorun.inf
-rwxr-xr-x 1 10335 11070 1414106 szept 1 11.06 __.exe
drwxr-xr-x 2 10335 11070 8192 szept 1 09.29 foto
-rwxr-xr-x 1 10335 11070 1414106 szept 1 11.06 foto.exe
-rwxr-xr-x 1 10335 11070 348160 szept 1 11.00 msvcr71.dll
drwxr-xr-x 3 10335 11070 8192 szept 1 04.34 nyomtat
-rwxr-xr-x 1 10335 11070 1414106 szept 1 11.06 nyomtat.exe
-rwxr-xr-x 1 10335 11070 3514318 szept 1 11.00 RavMonE.exe
-r-xr-xr-x 1 10335 11070 1414106 szept 1 11.06 Recycle.exe


It's nasty, isn't it? Sadly, I'm afraid I'll have to disinfect the drive to protect against potential spreading of the malware in question by executables. But wait, I always keep the source on the drive for every binary! So I will have to recompile all the SYSV LSB ELF executables, or else I could get infected! No wait, I only store programs in source form on the drive. But what if it could alter the source form by comprehending Haskell and Erlang? Good thing I always store hashes of directories and keep backups of everything I transfer until its successful reception. I had a great laugh anyway. :-D

Comments

Popular posts from this blog

Tftp secret of TL-WR740N uncovered

Hidden TFTP of TP-Link routers

Haskell for embedded: C output, compilers, monads, Timber