|
|
CF Card wiped out by Virus or Trojan?
|
|
|
|
Fresh-Faced Recruit
Join Date: Mar 2003
Status:
Offline
|
|
I believe I may have either a virus or a Trojan on my iMac. When we returned home from vacation I inserted a 1GB CF card into the reader. The card was recognized and the drive identified as “JO MAMA”. No pictures could be found on the card. When it was ejected and re-inserted – it was identified with no title. Again, no pictures. Approximately 600MB is noted as being available. Prior to inserting the card the pictures were readable within the camera (a Nikon SLR).
There are some Nikon folders on the card - no jpg's however in them.
I have used this same card many times without a problem.
It seems as if something on our system wiped out the card. Could it be a virus or trojan? I ran Virex 7.51 – it found no viruses/trojans. I checked the start-up items – there was nothing out of the ordinary.
Suggestions on what I might look for would be most appreciated.
Thanks - rob
|
|
|
|
|
|
|
|
|
Forum Regular
Join Date: Aug 2002
Location: London
Status:
Offline
|
|
Most likely it is a corrupt card. It does happen
Hopefully someone else can contibute more.
|
David.
|
|
|
|
|
|
|
|
Fresh-Faced Recruit
Join Date: Mar 2003
Status:
Offline
|
|
I would think it could be a corrupt card too -- except for the "JO MAMA" ID when I inserted it -- that seems too coincidental -- much like a virus or trojan. I couln't find any virus/trojan by that name however.
|
|
|
|
|
|
|
|
|
Clinically Insane
Join Date: Oct 2000
Location: Los Angeles
Status:
Offline
|
|
Perhaps you used it on a PC and it got a Windows virus.
|
"The natural progress of things is for liberty to yield and government to gain ground." TJ
|
|
|
|
|
|
|
|
Fresh-Faced Recruit
Join Date: Mar 2003
Status:
Offline
|
|
Good thought -- I don't go near a windows pc - even at the office I use a PB.
The card was not inserted in a PC - just the Nikon and the iMac. I'd like to think it's something other than a virus or a trojan. But something wiped out the card structure - I suspect the FAT32 directory - and it had to come from the mac. If it didn't show that funky title (JO MAMA) I probably would have chalked it up to a bad card.
I'm going to try recovery software on it tonight - I'll see if I can get my pictures back.
Thanks - rob
|
|
|
|
|
|
|
|
|
Clinically Insane
Join Date: Oct 2000
Location: Los Angeles
Status:
Offline
|
|
Weird, sorry that that happened to you.
|
"The natural progress of things is for liberty to yield and government to gain ground." TJ
|
|
|
|
|
|
|
|
Posting Junkie
Join Date: May 2001
Location: Portland, OR
Status:
Offline
|
|
Could you have mixed up your card with someone elses? There are no known viruses or trojans for the Mac.
|
8 Core 2.8 ghz Mac Pro/GF8800/2 23" Cinema Displays, 3.06 ghz Macbook Pro
Once you wanted revolution, now you're the institution, how's it feel to be the man?
|
|
|
|
|
|
|
|
Mac Elite
Join Date: Mar 2000
Location: Allston, MA, USA
Status:
Offline
|
|
I am certain it is one of the thousands of Mac OS X trojans and viruses. Anyone who tells you there aren't any on OS X is an Apple Apologist.
|
-- Jason
|
|
|
|
|
|
|
|
Clinically Insane
Join Date: Mar 2001
Location: yes
Status:
Offline
|
|
Originally Posted by jasong
I am certain it is one of the thousands of Mac OS X trojans and viruses. Anyone who tells you there aren't any on OS X is an Apple Apologist.
Can you cite an example of an OS X trojan or virus... one that is designed to propagate?
|
|
|
|
|
|
|
|
|
Addicted to MacNN
Join Date: Jan 2003
Location: ~/
Status:
Offline
|
|
Originally Posted by besson3c
Can you cite an example of an OS X trojan or virus... one that is designed to propagate?
I think its sarcasm.
|
|
|
|
|
|
|
|
|
Mac Elite
Join Date: Jan 2001
Location: Kansas City, Mo
Status:
Offline
|
|
Anyone notice all the new threads started by posters with less than 15 or so posts? Is this proof of switching or is something else going on here?
|
|
|
|
|
|
|
|
|
Grizzled Veteran
Join Date: Nov 2000
Location: USA
Status:
Offline
|
|
Originally Posted by robnbill
Good thought -- I don't go near a windows pc - even at the office I use a PB.
The card was not inserted in a PC - just the Nikon and the iMac. I'd like to think it's something other than a virus or a trojan. But something wiped out the card structure - I suspect the FAT32 directory - and it had to come from the mac. If it didn't show that funky title (JO MAMA) I probably would have chalked it up to a bad card.
I'm going to try recovery software on it tonight - I'll see if I can get my pictures back.
Thanks - rob
Is it possible someone picked up your camera and was playing around with it and renamed your card and fubar'd the data on it?
|
|
|
|
|
|
|
|
|
Fresh-Faced Recruit
Join Date: Mar 2003
Status:
Offline
|
|
I appreciate some of the comments. For background - we switched back to macs a little over two years ago -- after an absence of over 12 years. I do not have many posts in the forums (15 or less) - simply because we have had very few problems - and those I have had were easily solveable.
As far as someone picking up my camera and using it or messing with it - I know that didn't happen.
The behavior I described in my original post is very odd -- the card was good - it was readable by the Nikon prior to inserting it into the reader. Upon insertion it was recognized and the "drive" ID'd as "JO MAMA". At that point there were no images on the card. Ejecting it, removing it, and reinserting it resulted in the drive as being "untitled". Something on the mac, IMHO, wiped out the card. Had it not ID'd the way it did - I might have chalked it up as a fluke. I'm sure it's one of the thousands of viruses and trojans that exist on macs (sarcasm intended).
I ran a newer version of virex and it did find some java classes that were infected with the "exploitbyte" virus -- I think that was the name. However, I don't see how those classes could have executed on the system.
If I ever find out what caused the card to get wiped out (all the images, folders still exist with no jpg's) -- I'll post it. The card does have an odd file on it now -- not a normal Nikon file -- that is supposedly an Unix executable. No idea how that got there either. Not sure how to check it out.
All I was hoping to get on this forum was some advice as to where to look in the system files to see if I could find out what happened.
I did try various versions of photo recovery software - it appears I will be able recover most, if not all of the images.
Thanks
|
|
|
|
|
|
|
|
|
Mac Elite
Join Date: Mar 2001
Status:
Offline
|
|
Dude.
The file is not a UNIX executable. That's just how Mac OS X might see it by default.
And I guarantee you DO NOT have a "virus" or trojan. Absolutely categorically guarantee it.
This is what happened - and no, these aren't just wild guesses:
1. Someone accidentally deleted the contents while the card was in the camera
2. Someone accidentally deleted the contents while the card was attached to the computer
3. The card is/was corrupt, possibly a transient episode
But you DO NOT have some as-yet-unknown virus that erases only CF cards (or any external media for that matter).
Repeat: no, you don't have a virus or trojan. Someone/something just ****ed up somewhere, that's all.
Also, a lot of people seem to be getting the Java byteverify spyware lately, probably from a website they visit. Nevertheless, it doesn't affect Macs at all.
|
|
|
|
|
|
|
|
|
Clinically Insane
Join Date: Nov 1999
Status:
Offline
|
|
Is it possible that you accidentally mixed up this card with another one, perhaps belonging to somebody else? I've never heard of malware that specifically erases memory cards on any platform, so I have doubts as to whether that's what is going on.
|
You are in Soviet Russia. It is dark. Grue is likely to be eaten by YOU!
|
|
|
|
|
|
|
|
Administrator
Join Date: Apr 2001
Location: San Antonio TX USA
Status:
Offline
|
|
Compact Flash is hard to screw up. It takes an active effort to erase data on a CF card, and it takes time. It is very possible that the card is corrupt, and that formatting it on the Nikon will fix it, though it may be impossible to get your pictures back.
Here's another issue: how old is your iMac? I haven't delved into this issue yet, but 1GB CF cards are very new, and it's possible that your iMac just can't handle that particular card without some upgrade or other. It could also be the CF reader's fault for the same basic reason.
|
Glenn -----OTR/L, MOT, Tx
|
|
|
|
|
|
|
|
Fresh-Faced Recruit
Join Date: Mar 2003
Status:
Offline
|
|
piracy, Millennium & ghporter -- Thanks for your postings.
On causes - I think 1 and 2 is unlikely - I'm the only one that has access to the card. I would have to had taken very deliberate actions to wipe out the card.
As far as number 3 - I think that is more likely the cause - it may have had static electricity - maybe inserting/removing the card caused a transient problem and wiped out the directory on the card - the data is there based on a trial run of a recovery program. I should be able to recover most of the jpg's. I just need to decide which might be the best one.
Since the recovery program shows my pictures - it is my card. The mac is two years old - so is the SmartDisk reader. I've been using two 1GB cards for 5 or 6 months now without problems. I'll see if the SmartDisk reader may have had problems with large cards - could be another possibility.
We switched back to macs again because of the lack of viruses. And we have not had any problem like this.
My ONLY quandary now is how the card ended up being titled "JO MAMA" when I inserted it the first time. That behavior, IMO, could not happen randomly - then again maybe it could.
Again - Thanks for your input!!!
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Forum Rules
|
|
|
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
|
HTML code is Off
|
|
|
|
|
|
|
|
|
|
|
|