Malware on SanDisk, PNY thumbdrives - alternatives?

The SanDisk USB thumb drive I bought a couple months ago had programs on it that couldn’t be erased and were set to autoexecute. They created popups that wanted to install new menuing systems, Internet phone services, and other crap. I returned it and someone at the store said they’d had problems like that with SanDisk before, and suggested I try PNY. So I bought one and it was fine. Then Friday I bought another PNY model, specifically looking to see if it said it had any software on it and not finding any, and this one has similar programs. I fooled with it for a while but couldn’t get it to stop trying to install programs and take over control in some way - it looked like one item wanted to pass Start menu requests through some kind of filter, and modify them.

Both of these mounted as a disk drive and a separate CDROM drive that appeared to have folders with programs and autorun or similar hooks. This is not erasable memory and there doesn’t seem to be any way to change the configuration.

Who sells thumb drives that are just the drive? That is, just for storage, with no uninvited programs? Where can I order such drives on the web, or walk in and buy them? How can you tell if there’s unwanted, obtrusive, uneraseable software on a thumb drive if its package doesn’t say so? I’m not looking for which ones are better, just the facts - which ones are they?

You’re probably talking about “U3”, which is starting to show up on many models of flash drives. In theory it’s not malicious but it’s a royal PITA. It’s installed as a non-erasable, non-formatable partition which is formatted as CDFS, so your PC thinks it is a CD-ROM. There’s an autorun in there that executes some little utility which many flash drive makers think you will like.

Per U3’s website, they state that it doesn’t actually install anything on your PC, applications run 100% from the flash drive itself (idea being you can install your favorite browser or other apps on the thumb drive and tote them along).

I found it annoying and sucky so I returned the drives I’d just bought and found some (Kingston, IIRC) that didn’t have the little U3 logo on the package.

There is a reformat utility available however it’s specific to each model/manufacturer (i.e. if you have a SanDisk thumb drive, check SanDisk’s website).

Here’s some info from U3:

http://www.u3.com/support/#CQ3

I simply formatted the SanDisk from Windows Explorer the same way as I would format a floppy diskette. (Though I confess that it took me a long time to finally figure out that solution, after endlessly deleting files and seeing them magically restored.)

Thank you. I’d find that *really *annoying. I hate shit like that.

>It’s installed as a non-erasable, non-formatable partition…

>I simply formatted the SanDisk from Windows Explorer the same way as I would format a floppy diskette.

These sound contradictory - anybody know the resolution?

Anyway, I don’t want to buy products from mfrs who do this.

>many flash drive makers think you will like…
Now, this is pretty hard to believe. Somebody is giving money to flash drive makers to put their software on the drive and make it impossible (or difficult?) to erase. There must be some way that that “somebody” can get more money out of us. Television broadcasters don’t include commercial advertisements in their broadcasts because we think we will like them, and I can’t imagine that SanDisk and PNY are doing it here for that reason either.

An idea out of the top of my head, if it really gets annoying and the system won’t let you format the flash drive: you could download and burn a Linux CD image, like Ubuntu, that you don’t need to install.

Booting Linux all the stuff on the flash drive will be ignored and you’ll be able to wipe it clean, and format it if you want.

You can get the same advantage without the crapware using Portable Apps.

The SanDisk U3 removal program is here.

Well, the idea is that a lot of systems won’t let you do autorun off a regular thumb drive. I’ve certainly run into this even with newer thumb drives that work with autorun in XP. They decided to implement this feature through a little fake ROM area with software handling it instead of forcing everybody in the world to update their OS. It would be a drag if this feature could be accidentally “deleted” permanently by deleting files off the thumb drive. It’s strange they don’t offer a way to disable it by writing some sort of a config file to the writable area, however. Yeah, if you can reformat/repartition it, it’ll be gone, but you’ll lose the features.

This thumb drive mounts as a rewritable disk plus a CDROM. I can format the rewritable disk but the crapware is still on the CDROM and still runs when I plug it in.

>You can get the same advantage without the crapware…
>Yeah, if you can reformat/repartition it, it’ll be gone, but you’ll lose the features.

I wanted storage. If I’d wanted intrusive software, I’d have bought Vista instead. It’s going back to the store.

Anybody know of a thumb drive that provides storage without crapware? Valgard thought Kingston didn’t have this - anybody know for sure? This does indeed have U3 on it, but the previous one didn’t, it was trying to sell Skype and a few other things. Is there any way to tell whether a product has NO crapware?

I’ve been very pleased with Memorex USB drives (they call them traveldrive).

They didn’t have any crapware as of my most recent purchase (~6 mos. ago)

Don’t get me wrong, I completely understand this. Their attempt at accomplishing this sucks. However, you can’t entirely blame the manufacturers for something that Microsoft screwed up so badly. When I bought my first thumb drive it didn’t even occur to me that autorun did not work with plain thumb drives – and I actually returned it to the store because of that. Storage on Windows means support for autorun and support for booting windows off of it. Due to shortcomings in Windows, USB mass storage devices in general lack the latter and USB flash drives specifically lack the former. Without those two features they’re not real storage devices in my eyes. If you don’t need those features, then of course you want a flash drive that doesn’t install anything! I’d be pissed too!

Unless they changed it, the only thing Corsair puts on their thumb drives is a portable version of TrueCrypt (an open-source cryptography system), so you might want to check this drive out.

Well that is a bullshit way to do business, and I’m glad I heard about it. I know one company that I’ll not be buying from until they stop it.

This almost sounds like you have some legitimate use for autorun. Could you elaborate further? I was not aware that it was good for anything besides scumware of various sorts.
Meanwhile, if the autorun USB drives work by mimicing a CD, would turning off CD autoplay also disable it on the USB drives?

I agree with Chronos. I cannot really think of anything that needs autorun. It can be somewhat nice to just put a disk in and have the program start. But when supposedly legitimate companies like sony put malware on CDs it is best to turn off autorun.

Booting off of a CD or a thumb drive is not auto run it is a bios feature.

Well I had planned out a small program that would automatically synchronize my key documents, software projects, set of scripts, booksmarks, etc. between four computers I was using at the time as soon as I plugged in my key. I kept forgetting to synchronize to or from the key and it was proving to be a major time waster. Using files straight on the key was not really an option because it wasn’t particularly fast and would quickly wear out the thumb drive (a lot of it was code I routinely recompiled). Another thing I envisioned was automatically prompting me for my TrueCrypt passphrase upon insertion. Autorun on USB would basically be a lifesaver in coping with ADD :stuck_out_tongue:

The U3 autorun surprised me at first. Okay, it pissed me off when I thought it had installed something automatically on my PC. I looked into it and (as far as I can tell) it doesn’t install anything permanently, it’s just running a program.

It might be useful in certain circumstances but it’s not something I need right now.

Just buy a flash drive you think you will like and if you don’t want U3, uninstall it.

It is not difficult or impossible to uninstall/erase. I cleaned my SanDisk cruzer with a program I accessed through the U3 launch pad. Sure, you have to let it run once to get to the uninstall/erase program but that’s it.

The uninstall program on my SanDisk said it could not be reinstalled.

I was a little sleepy when I answered the first time and I misinterpreted this statement. In general autorun is incredibly useful. Although I abhor software doing things without my permission, not being flexible enough, or thinking for me and making bad decisions, I also believe that there should be a maximum single-action default for any user interface interaction. Most of the time people insert CDs into the computer to do something with the CD – giving the software vendor an option of using that single action of CD insertion is important (giving the user the ability to disable this feature on their computer doubly so).

So many pieces of professional software I consider simply unusable because the developers prioritized a unified approach and flexibility over usability. The most recent example I have encountered is diagramming software –

  1. Click rectangle on pallete
  2. Drag it out on the canvas
  3. Click or double-click to select it
  4. Paste/type text
  5. Click outside on the canvas to de-select (in some packages this is optional)
  6. Click link on pallete
  7. Choose one endpoint
  8. Drag or simply point to the other end-point and click

8 fairly reasonable steps to add a box with text to a diagram and link it to something. That’s rather flexible, all sorts of predefined shapes and arrows and things… but this is too close to MS Paint for my comfort. In fact, diagramming software seems to be a degenerate form of illustration software with a nice shape library and XML export, and that’s ridiculous :mad:

Software should react simply, accurately and usefully to simple actions but still allow complex behaviors to be achieved through complex actions. There’s no excuse for Microsoft Visio for not being able to build an unconnected appropriately scaled diagram automatically by me repeatedly pasting into it. When I have to chart something out for myself the last thing I want is to keep dragging boxes around pasting into them.

Most applications do not have a reasonable default for very common “single actions” that all applications support to one degree or another. What happens if you drag or paste things into them without extra steps for example – most applications will not let you configure that behavior nor will they react appropriately. Sometimes the configuration is there but not obvious. I still don’t know how to make “Paste Special → Unicode Unformatted” the default behavior for “Edit → Paste” in Microsoft Office applications.

Autorun is a pleasant deviation from that – you can turn it off, you can turn it off on a case-by-case basis, or you can leave it on and it’s a single action behavior. It’s unfortunate if some software vendors abuse it, but most do not. If I put in most software CDs I will be prompted with a nice menu giving me the choices to install, read the manual or visit their website. Expecting everyday users to double-click on My Computer, locate their CD-ROM drive, double-click on it, figure out which of the files on it is the executable that installs the right thing and run it is not a realistic expectation. It would be nice if users knew what a file is, but computers are supposed to be tools and frankly they shouldn’t have to.

In this way I agree with the Amish. It is very easy for technology to enslave us. Learning complicated things is like a modern rite of passage that shouldn’t be there. If you are happy bringing your car to the dealership on a fixed schedule and paying out of your ass for them to do nothing simply because you don’t have to clutter your head with worries of when you need your spark plugs changed.

In my experience, yes. If autorun is disabled, it’s disabled.

>In this way I agree with the Amish. It is very easy for technology to enslave us.

Before we all go jumping into bed together, let’s be more accurate about the Amish. Their argument isn’t with technology. For example, they’re very happy to use cars and telephones. I live near many Amish and other Pennsylvania Dutch - in fact my own family was Pennsylvania Dutch several generations back. The way those people splash insecticide around is frightening - and all those black clothes are polyester. What they aren’t allowed to do is various forbidden activities that encourage regular interaction with the English (that is, us). So they can’t own cars or telephones, because those things kind of bring along with them frequent interaction with the English. But they can go over to the English neighbor’s house and use them there. Without their own phone number, they’re not going to get sales calls, and the teens aren’t going to spend the evening talking, you see.

>It is not difficult or impossible to uninstall/erase. I cleaned my SanDisk cruzer with a program I accessed through the U3 launch pad. Sure, you have to let it run once to get to the uninstall/erase program but that’s it.

Really? I have to try this! Thanks!

Hmm, are you sure about this? The way I always understood it was that prohibition wasn’t against use of technology nor contact with the English. The prohibition was against dependence on something or someone from outside of their community. Anything you make with your own two hands is fair game, as well as any opportunistic non-excessive use of outside technology as long as you do form reliance on the English for your day-to-day needs. Have I misunderstood?