Abstract

I have a FAT32 memory card that when inserted into a computer causes Windows to prompt to format it. The card is definitely not supposed to be blank and has a bunch of files on it.

Symptoms

Using a hex-editor/disk-viewer, I examined the card and found that several sectors/clusters have been overwritten with something that has a signature of USBC at the start of the sector. Specifically, the master boot record (and partition table) is gone (hence Windows thinking the card is blank and needing to be formatted), as are the boot sectors (they have the USBC signature and a volume label of NO NAME and partition type of FAT32).

Fortunately, it looks like both copies of the FAT are almost entirely intact (a few FAT entries at the start of a cluster here and there seem to be overwritten by USBC). The root directory is also nearly intact—I can see the volume label entry and subdirectory listings, but one sector is overwritten. (There are no more instances of USBC after the last one in the FAT2.)

Hypothesis

These observations seem to indicate some sort of virus that erases a few key filesystem structures, and then overwrites a few extra sectors here and there. Googling it seems to corroborate the idea of a virus, except that others report a file called USBC which does not apply here, and in fact, could not be possible since there is no filesystem to even see files. I cannot find any information about a virus with these symptoms, nor a removal tool. (I can't help but wonder if it is actually due to an autorun virus prevention tool.)

Question

I can likely fix the FAT corruption since they are mostly contiguous chains and maybe even the lost sector of the root directory, but does anyone know of a convenient way to restore or (re)create the MBR/partition table and boot sectors (without formatting or overwriting the data)?

The first tool you should try for MBR/partition table recovery is testdisk, which has a good documentation and is easy to use. I suggest reading this guide.

I have experienced the same issue. This is not a virus. It's a electronic failure in the memory card reader (at least in my case).

After formatting I have tried to use another card on this computer using another memory card reader without any problem. However, when I insert another memory card with the suspected memory card reader it immediately corrupted it.

I have had and I have again the same problem.

I have external USB HDD from ADATA type NH92. It is formatted as NTFS. Once I discovered that some files are missing and later more and more files were lost. Finally disk was corrupted and Windows requested to format it. I reformatted HDD 2 or 3 times, due problems repeated then I claimed the disk.

New HDD worked a half of year without any issue. Then problems started again. I have discovered using WinHex disk editor that Master Boot record is corrupted. I studied NTFS. I restored Boot record by copying from the other HDD with the same capacity, partitions and NTFS. I verified MFT location. I saw first sector of the table starts with USBC signature. Others MFT files records had the same first sector signature and rest of sector has couple of other bytes and then continue with zeros. I found out that each sector with signature has shifted data to second half of sector. So I moved this data back to original location and did check disk. HDD was recovered. Two weeks later the same happened. I checked PC by antivirus without any result. I used 3 different programs include McAfee. No result. Virus wasn´t found.

I supposed virus is focused on NTFS so I reformatted HDD to FAT32. After some time period some sectors were overwritten by USBC signature again and HDD file system was destroyed. I sent PC to manufacturer, it was fully reformatted and Windows was reinstalled. Also I reformatted HDD and created two logical partitions with same data to have backup.

Today I have problem again. I discovered that second logical disk is destroyed. I checked HDD by winHex and I have found out that also logical disk which looks OK, has more as 100 sectors with USBC signature but all files records in MFT are still OK. I suppose also this logical disk will be destroyed soon.

Interesting point is that ADATA NH92 HDD has problems only and on this PC only. I used ADATA NH92 on other PC without problem; I used other HDD on this PC without problem, too. I am going to do long term observation to use on this PC permanently other HDD and to use ADATA NH92 on different PC only.

Time to time I will search both HDDs for sector signature. So I will see.

Regards, Michal