Solved

Why are my USB sticks being wiped out by windows 7?

Posted on 2013-12-10
9
370 Views
Last Modified: 2016-11-23
Hello,
I have a user that has had 2 128gig USB sticks wiped clean on her dell xps 13 running win7 pro sp1 fully updated. Last weekend she called me in a panic telling me the her USB was blanked out...I figured it was hardware failure. Well today she had another 128gig stick wiped out again. USB sticks are now unformatted - user knows how to safely remove them. We do not have policy's in place to prevent using usbs- this user is an admin on her machine.
The USB sticks are microcenter branded 128gig - so could it be possible that they are crap? Or is windows really reformatting them on its own?
Any help would be appreciated.
Michael
0
Comment
Question by:sohomyriad
9 Comments
 
LVL 23

Expert Comment

by:Thomas Grassi
ID: 39709649
My question is where else are these USB sticks being used?

On a MAC?

I only saw this type of issue when a usb pen drive was formatted on Windows then placed in a Mac and the Mac write a file to the drive. The Pc was unable to read the USB Pen drive again.
This does not happen al the time but it has caused issue I seen.

Windows does not automatically format any drive you are prompted to do so.

You should have had a message when the drive was unreadable what was that?
0
 
LVL 31

Expert Comment

by:Frosty555
ID: 39709674
A common malware trick is to "infect" a USB drive by copying a malicious program onto it, and creating an autorun.inf file that automatically runs the executable when it is plugged into a vulnerable machine.

If you have some malware on the computer which is attempting to do this, but doing a poor job and corrupting the filesystem of the USB stick in the process... that would also explain it.

It'd be a pretty rare thing to see, so I wouldn't spend too much time investigating down this path, but maybe a quick look at the computer with Sysinternals Autoruns or Hijackthis for anything suspicious looking would be prudent.
0
 
LVL 51

Accepted Solution

by:
Joe Winograd, EE MVE earned 500 total points
ID: 39709675
They could be fake/counterfeit sticks. This is a not an uncommon occurrence with flash memory cards/drives/sticks. I've been using H2testw for many years to test every flash memory device that I buy:

http://www.softpedia.com/get/System/System-Miscellaneous/H2testw.shtml

Here's what its output looks like when the drive is clean:

Test finished without errors.
You can now delete the test files *.h2w or verify them again.
Writing speed: 40.1 MByte/s
Reading speed: 76.6 MByte/s
H2testw v1.4

Here's its output when it finds a problem (this was a 4GB card with some bad memory):

The media is likely to be defective.
3.8 GByte OK (8093404 sectors)
146 KByte DATA LOST (292 sectors)
Details:139.5 KByte overwritten (279 sectors)
2.5 KByte slightly changed (< 8 bit/sector, 5 sectors)
4 KByte corrupted (8 sectors)
93.5 KByte aliased memory (187 sectors)
First error at offset: 0x000000007707a408
Expected: 0x7707a406f9729c11
Found: 0xf907a406f932b511
Writing speed: 898 KByte/s
Reading speed: 4.91 MByte/s
H2testw v1.4

Here's an example of another bad one (this was a fake 32GB card):

The media is likely to be defective.
230.4 MByte OK (471942 sectors)
31.0 GByte DATA LOST (65029242 sectors)
Details:738.3 MByte overwritten (1512137 sectors)
0 KByte slightly changed (< 8 bit/sector, 0 sectors)
30.2 GByte corrupted (63517105 sectors)
738.3 MByte aliased memory (1512137 sectors)
First error at offset: 0x0000000001410008
Expected: 0x0141000012cf0011
Found: 0x0141000012c40011
Writing speed: 3.81 MByte/s
Reading speed: 3.74 MByte/s
H2testw v1.4

H2testw is often referred to as the Gold Standard for finding fake flash memory. I suggest that you give it a spin on those two sticks. Regards, Joe
0
 
LVL 91

Expert Comment

by:nobus
ID: 39710675
did you run mbam and roguekiller yet?
http://www.malwarebytes.org/mbam.php                         MBAM
http://majorgeeks.com/RogueKiller_d6983.html                  Roguekiller
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:sohomyriad
ID: 39725661
Hello Everyone...Sorry for the delay in getting back to you. Firstly I'd like to thank you all for your input on this problem. The end user told me that only one of the two usb sticks went to the grave. Ended up sending the bad/dead one off to a data recover specialist who advised me that the USB on board software was corrupt. He was able to extract 99% 50gigs of data off the useless stick  - We both agreed that the stick was low quality and the 128gig stick are just not ready for daily use yet.

Again thank you!!

Michael
0
 
LVL 51

Expert Comment

by:Joe Winograd, EE MVE
ID: 39725687
Michael,
Thanks for the update. Is this the Micro Center 128GB stick that you're talking about:
http://www.microcenter.com/product/411158/128GB_SuperSpeed_USB_30_Flash_Drive_-_Gray

I'd like to know what not to buy. :)   Regards, Joe
0
 

Author Comment

by:sohomyriad
ID: 39725704
That's the one Joe...I'd advise against purchasing that product. Sorry Microcenter
0
 
LVL 51

Expert Comment

by:Joe Winograd, EE MVE
ID: 39725840
Thanks, Michael, appreciate the tip.
0
 
LVL 51

Expert Comment

by:Joe Winograd, EE MVE
ID: 39748621
Hi Michael,
Where do things stand on this effort? If it's wrapped up at this point, please close out this question. If it's not wrapped up, let us know what issues remain. Thanks, Joe
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Article by: Lee
Windows 7 Ultimate and Enterprise (and 2008 R2) introduced a new feature you may not be aware of - Boot from VHD.   Boot from VHD (or what Microsoft refers to asNative Boot allows you to install Windows to a VHD (Virtual Hard Disk) file that is t…
If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
This Micro Tutorial will teach you how to change your appearance and customize your Windows 7 interface to your unique preference. This will be demonstrated using Windows 7 operating system.
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum editing capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now