Welcome to the MacNN Forums.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

You are here: MacNN Forums > Software - Troubleshooting and Discussion > macOS > CF Card wiped out by Virus or Trojan?

CF Card wiped out by Virus or Trojan?
Thread Tools
robnbill
Fresh-Faced Recruit
Join Date: Mar 2003
Status: Offline
Reply With Quote
May 11, 2005, 11:14 AM
 
I believe I may have either a virus or a Trojan on my iMac. When we returned home from vacation I inserted a 1GB CF card into the reader. The card was recognized and the drive identified as “JO MAMA”. No pictures could be found on the card. When it was ejected and re-inserted – it was identified with no title. Again, no pictures. Approximately 600MB is noted as being available. Prior to inserting the card the pictures were readable within the camera (a Nikon SLR).

There are some Nikon folders on the card - no jpg's however in them.

I have used this same card many times without a problem.

It seems as if something on our system wiped out the card. Could it be a virus or trojan? I ran Virex 7.51 – it found no viruses/trojans. I checked the start-up items – there was nothing out of the ordinary.

Suggestions on what I might look for would be most appreciated.

Thanks - rob
     
DavidHossack
Forum Regular
Join Date: Aug 2002
Location: London
Status: Offline
Reply With Quote
May 11, 2005, 12:56 PM
 
Most likely it is a corrupt card. It does happen

Hopefully someone else can contibute more.
David.
     
robnbill  (op)
Fresh-Faced Recruit
Join Date: Mar 2003
Status: Offline
Reply With Quote
May 11, 2005, 01:12 PM
 
I would think it could be a corrupt card too -- except for the "JO MAMA" ID when I inserted it -- that seems too coincidental -- much like a virus or trojan. I couln't find any virus/trojan by that name however.
     
Big Mac
Clinically Insane
Join Date: Oct 2000
Location: Los Angeles
Status: Offline
Reply With Quote
May 11, 2005, 03:23 PM
 
Perhaps you used it on a PC and it got a Windows virus.

"The natural progress of things is for liberty to yield and government to gain ground." TJ
     
robnbill  (op)
Fresh-Faced Recruit
Join Date: Mar 2003
Status: Offline
Reply With Quote
May 11, 2005, 03:39 PM
 
Good thought -- I don't go near a windows pc - even at the office I use a PB.

The card was not inserted in a PC - just the Nikon and the iMac. I'd like to think it's something other than a virus or a trojan. But something wiped out the card structure - I suspect the FAT32 directory - and it had to come from the mac. If it didn't show that funky title (JO MAMA) I probably would have chalked it up to a bad card.

I'm going to try recovery software on it tonight - I'll see if I can get my pictures back.

Thanks - rob
     
Big Mac
Clinically Insane
Join Date: Oct 2000
Location: Los Angeles
Status: Offline
Reply With Quote
May 11, 2005, 03:41 PM
 
Weird, sorry that that happened to you.

"The natural progress of things is for liberty to yield and government to gain ground." TJ
     
goMac
Posting Junkie
Join Date: May 2001
Location: Portland, OR
Status: Offline
Reply With Quote
May 11, 2005, 04:34 PM
 
Could you have mixed up your card with someone elses? There are no known viruses or trojans for the Mac.
8 Core 2.8 ghz Mac Pro/GF8800/2 23" Cinema Displays, 3.06 ghz Macbook Pro
Once you wanted revolution, now you're the institution, how's it feel to be the man?
     
jasong
Mac Elite
Join Date: Mar 2000
Location: Allston, MA, USA
Status: Offline
Reply With Quote
May 11, 2005, 06:44 PM
 
I am certain it is one of the thousands of Mac OS X trojans and viruses. Anyone who tells you there aren't any on OS X is an Apple Apologist.
-- Jason
     
besson3c
Clinically Insane
Join Date: Mar 2001
Location: yes
Status: Offline
Reply With Quote
May 11, 2005, 07:04 PM
 
Originally Posted by jasong
I am certain it is one of the thousands of Mac OS X trojans and viruses. Anyone who tells you there aren't any on OS X is an Apple Apologist.
Can you cite an example of an OS X trojan or virus... one that is designed to propagate?
     
Cadaver
Addicted to MacNN
Join Date: Jan 2003
Location: ~/
Status: Offline
Reply With Quote
May 11, 2005, 07:25 PM
 
Originally Posted by besson3c
Can you cite an example of an OS X trojan or virus... one that is designed to propagate?
I think its sarcasm.
     
kcmac
Mac Elite
Join Date: Jan 2001
Location: Kansas City, Mo
Status: Offline
Reply With Quote
May 11, 2005, 08:18 PM
 
Anyone notice all the new threads started by posters with less than 15 or so posts? Is this proof of switching or is something else going on here?
     
iKevin
Grizzled Veteran
Join Date: Nov 2000
Location: USA
Status: Offline
Reply With Quote
May 11, 2005, 08:35 PM
 
Originally Posted by robnbill
Good thought -- I don't go near a windows pc - even at the office I use a PB.

The card was not inserted in a PC - just the Nikon and the iMac. I'd like to think it's something other than a virus or a trojan. But something wiped out the card structure - I suspect the FAT32 directory - and it had to come from the mac. If it didn't show that funky title (JO MAMA) I probably would have chalked it up to a bad card.

I'm going to try recovery software on it tonight - I'll see if I can get my pictures back.

Thanks - rob
Is it possible someone picked up your camera and was playing around with it and renamed your card and fubar'd the data on it?
     
robnbill  (op)
Fresh-Faced Recruit
Join Date: Mar 2003
Status: Offline
Reply With Quote
May 12, 2005, 09:29 AM
 
I appreciate some of the comments. For background - we switched back to macs a little over two years ago -- after an absence of over 12 years. I do not have many posts in the forums (15 or less) - simply because we have had very few problems - and those I have had were easily solveable.

As far as someone picking up my camera and using it or messing with it - I know that didn't happen.

The behavior I described in my original post is very odd -- the card was good - it was readable by the Nikon prior to inserting it into the reader. Upon insertion it was recognized and the "drive" ID'd as "JO MAMA". At that point there were no images on the card. Ejecting it, removing it, and reinserting it resulted in the drive as being "untitled". Something on the mac, IMHO, wiped out the card. Had it not ID'd the way it did - I might have chalked it up as a fluke. I'm sure it's one of the thousands of viruses and trojans that exist on macs (sarcasm intended).

I ran a newer version of virex and it did find some java classes that were infected with the "exploitbyte" virus -- I think that was the name. However, I don't see how those classes could have executed on the system.

If I ever find out what caused the card to get wiped out (all the images, folders still exist with no jpg's) -- I'll post it. The card does have an odd file on it now -- not a normal Nikon file -- that is supposedly an Unix executable. No idea how that got there either. Not sure how to check it out.

All I was hoping to get on this forum was some advice as to where to look in the system files to see if I could find out what happened.

I did try various versions of photo recovery software - it appears I will be able recover most, if not all of the images.

Thanks
     
piracy
Mac Elite
Join Date: Mar 2001
Status: Offline
Reply With Quote
May 12, 2005, 09:53 AM
 
Dude.

The file is not a UNIX executable. That's just how Mac OS X might see it by default.

And I guarantee you DO NOT have a "virus" or trojan. Absolutely categorically guarantee it.

This is what happened - and no, these aren't just wild guesses:

1. Someone accidentally deleted the contents while the card was in the camera
2. Someone accidentally deleted the contents while the card was attached to the computer
3. The card is/was corrupt, possibly a transient episode

But you DO NOT have some as-yet-unknown virus that erases only CF cards (or any external media for that matter).

Repeat: no, you don't have a virus or trojan. Someone/something just ****ed up somewhere, that's all.

Also, a lot of people seem to be getting the Java byteverify spyware lately, probably from a website they visit. Nevertheless, it doesn't affect Macs at all.
     
Millennium
Clinically Insane
Join Date: Nov 1999
Status: Offline
Reply With Quote
May 12, 2005, 10:28 AM
 
Is it possible that you accidentally mixed up this card with another one, perhaps belonging to somebody else? I've never heard of malware that specifically erases memory cards on any platform, so I have doubts as to whether that's what is going on.
You are in Soviet Russia. It is dark. Grue is likely to be eaten by YOU!
     
ghporter
Administrator
Join Date: Apr 2001
Location: San Antonio TX USA
Status: Offline
Reply With Quote
May 12, 2005, 01:05 PM
 
Compact Flash is hard to screw up. It takes an active effort to erase data on a CF card, and it takes time. It is very possible that the card is corrupt, and that formatting it on the Nikon will fix it, though it may be impossible to get your pictures back.

Here's another issue: how old is your iMac? I haven't delved into this issue yet, but 1GB CF cards are very new, and it's possible that your iMac just can't handle that particular card without some upgrade or other. It could also be the CF reader's fault for the same basic reason.

Glenn -----OTR/L, MOT, Tx
     
robnbill  (op)
Fresh-Faced Recruit
Join Date: Mar 2003
Status: Offline
Reply With Quote
May 12, 2005, 07:29 PM
 
piracy, Millennium & ghporter -- Thanks for your postings.

On causes - I think 1 and 2 is unlikely - I'm the only one that has access to the card. I would have to had taken very deliberate actions to wipe out the card.

As far as number 3 - I think that is more likely the cause - it may have had static electricity - maybe inserting/removing the card caused a transient problem and wiped out the directory on the card - the data is there based on a trial run of a recovery program. I should be able to recover most of the jpg's. I just need to decide which might be the best one.

Since the recovery program shows my pictures - it is my card. The mac is two years old - so is the SmartDisk reader. I've been using two 1GB cards for 5 or 6 months now without problems. I'll see if the SmartDisk reader may have had problems with large cards - could be another possibility.

We switched back to macs again because of the lack of viruses. And we have not had any problem like this.

My ONLY quandary now is how the card ended up being titled "JO MAMA" when I inserted it the first time. That behavior, IMO, could not happen randomly - then again maybe it could.

Again - Thanks for your input!!!
     
   
Thread Tools
 
Forum Links
Forum Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Top
Privacy Policy
All times are GMT -4. The time now is 05:10 AM.
All contents of these forums © 1995-2017 MacNN. All rights reserved.
Branding + Design: www.gesamtbild.com
vBulletin v.3.8.8 © 2000-2017, Jelsoft Enterprises Ltd.,