Virus moving trough P2 cards! Beware!

N

newsbykko

Active member
Yesterday we discovered we could not import our P2 footage into CS3 after copying the "contents" folder from our P2 cards. After 6 hours we figured out that a virus had made a FAKE "contents" folder on all our P2 cards. :Drogar-Smoke(DBG):


Basically one of our laptops was infected with a very vicious Trojan virus that infected all our P2 cards and was able to install itself from the P2 cards every time we tried to copy a fake "contents" folder.

Here is how it worked.

The virus infects a computer from some place and then installs itself on any external media Hard Drive or in our case all our P2 card.
Now it gets fun. Once in the P2 card the virus makes a FAKE copy of the "contents" folder with a copy of the virus in it and changes the real "contents" folders properties to "not visible". (Obviously if this was some other media IE: HD or USB drive it would copy some other file. I’m sure this is not only for P2 cards)

So, now when I went to copy my "contents" folder with my P2 footage all I saw was the FAKE folder with the invisible virus. Not knowing I copied the folder to my Hard Drive.
Once I opened CS3 I noticed that I obviously could not import any of the footage and the "contents" folder since it was only 19.9Mgb as opposed to the normal 16G.

Only after I changed the folder options to "show hidden files" did I see BOTH "contents" files and realize one was fake.

We scanned the P2 cards and laptop with AVAST anti virus and found everything infected with a Trojan virus. The fake "contents" folder had the virus and a self install program.

The shocking part is even after we FORMATED the card in the HVX the fake "contents" file was still there! Only AVAST was able to delete the fake "contents" file of the infected P2 cards.

We don’t know where this virus came from but it has done tremendous amounts of damage.

Beware that this is out there and simple putting your P2 card in a infected laptop will cause it to get infected. Nether Norton anti virus or Spybot saw the virus.

To the benefit of all the Apple people out there our G5 saw both "contents" folders and the virus did not effect it. Also Panasonic softwear was still able to "ingest" all the footage.

Fun day at the office....................:thumbup:

Kris
 
Well I suppose the P2 is only a hard drive as far as the computer is concerned.

Interesting that formatting on the camera wouldn't get rid of it though.
 
ROne said:
Well I suppose the P2 is only a hard drive as far as the computer is concerned.

Interesting that formatting on the camera wouldn't get rid of it though.
Click to expand...

Even when we tried to delete or format on the laptop it still would not go away. Only way to get rid of it is to use the anti virus software.

This is definitely the mother of all viruses....

Manged to infect the contents of 5 hours of expensive Beijing footage. Trying to figure out how to recover the footage without the virus.

Looks like I have to use FCP on a Mac to try to export out some clean Quick time copies since the Mac does not seem to be effected.

This sucks.....
 
Sucks indeed. That's scary stuff. It seems like a tailor made virus for P2 cards. Why the hell would some one write something like that. Like we don't have enough issues already.
 
This just adds to one of the things I cannot stress enough: Always always always copy protect cards when the leave the cameras.

Formatting from the camera does not fix the issue? that's pretty interesting.

Filth - It doesn't sound like a tailor made virus for P2. Simply a nasty virus that attacks and replicates itself through removable media.
 
Sounds like it will do the same to a sony SxS card or SD card. Did the virus have any effect on your camera or reset the settings? This could be devastating to a large production.

What was the name of the Trojan and what details did AVAST provide about it?
 
There's some big virus going around thats infecting a bunch of systems. I read about it on google. All 4 of my PC's got infected with it at different times (surprise! my Mac is ok). Like you said it infects any media connected to the system and spreads when it sees other drives.

Have you tried importing with P2CMS? Thats how you should do it anyway.

Funny, how two of my systems got infected were by the women of the house here looking at fat pictures of Jessica Simpson. Thats what they get. =)
 
is there a test i can perform RIGHT NOW with my p2 cards that would tell me if they are infected


what are the signs?
 
ChipG said:
Sounds like it will do the same to a sony SxS card or SD card. Did the virus have any effect on your camera or reset the settings? This could be devastating to a large production.

What was the name of the Trojan and what details did AVAST provide about it?
Click to expand...

I used the camera today and it seems unaffected. That's good.

I would say "devastating" is the correct adjective for this situation. So far 5 infected Hard Drives with 8 hours of infected footage and several hundred pictures that are also now bad.....

I will try to get more info on the virus once we fix the other laptop. Right now I am busy trying to salvage footage.

FYI: I'm not an expert, but I'm pretty sure this virus will effect any sort of media IE: Hard Drives, Sony SD cards, USB drives ext. This is not a P2 specific thing.


This is fun..
 
Just change your Windows settings to "show hidden files" If you see TWO contents folders on a P2 card you have a problem. And if there is TWO "contents" folders then the "hidden" one is the real folder and the "visible" one is the virus.

I think Mac will automatically see both "contents" folders. Mac also seems unaffected, but I don't know if it can pass the virus to an other media source like a external HD.
 
Guys hate to tell you, but Macs get virus too. Especially now that mac opened up the flood gate (windows on a mac). Sucks, but don't think we are untouchable anymore....
:)


4 weeks ago a friend of mine got a virus on his PowerPC Quad and it erased his whole drive. Yea that really sucked for him and time machine didn't recover anything.... :crybaby:

Had to reshoot two projects and start almost all over. Luckily he media managed about half way thru the project, but didn't get every thing...





newsbykko

Post your problem here and I'm sure one of these guys will know what to do.

http://forums.macosxhints.com/index.php
 
Last edited:
twocik23 said:
Guys hate to tell you, but Macs get virus too. Especially now that mac opened up the flood gate (windows on a mac). Sucks, but don't think we are untouchable anymore....
:)


4 weeks ago a friend of mine got a virus on his PowerPC Quad and it erased his whole drive. Yea that really sucked for him and time machine didn't recover anything.... :crybaby:

Had to reshoot two projects and start almost all over. Luckily he media managed about half way thru the project, but didn't get every thing...
newsbykko

Post your problem here and I'm sure one of these guys will know what to do.

http://forums.macosxhints.com/index.php
Click to expand...

He must have been the only one that got it otherwise we would all have known about it. Mac communities would be all over it. The last known virus for the Mac was some weird trojan in iWork, not even considered a virus, nor anything as harmful as you're describing. His "virus" sounds more like user or hardware error.
 
can the virus infect if i just view the files on p2 card through p2 reader? or does it only cause problem when downloading the footage into the computer
 
You must log in or register to reply here.
Back
Top