Sneaky Bastard

I was at my local Office Depot late last night to pick up a USB flash drive for a project. I needed a simple device — 1 Gb was plenty of space to move some security certificates and keys between computers. I ran into the store just as they were closing and grabbed the cheapest USB flash drive I could find (SanDisk Cruzer Micro 1 Gb for $14.99). I had heard about flash drives that contain the U3 root kit, but never used one. I stuck the drive into a Mac and reformatted the partition. I then discovered that the device still emulated a CD-ROM drive and did not show that as a real partition. Ugh.

After reading about U3 “enhanced” flash drives, it became apparent that the only way to turn the device into a plain flash drive was to use their uninstaller application from Microsoft® Windows™. Luckily for me, I still have one PC that runs Windows. I don’t use Windows inside a virtual machine, although I certainly could. I’m not sure the VM would have had enough hardware access to the USB device to uninstall the root kit anyway. Regardless, I ran the uninstaller and created a perfectly usable device for moving bits around. Neato.