# [SOLVED] strange device mounted ? am I hacked?

## Joseph_sys

I've a strange USB device showing up when I click on mount-desktop icon, the device is showing up as:

/dev/sdb1 

THE are NO USB DEVICES PLUGGED IN into external ports.

in my fstab:

```
...# USB Stick Camera etc

/dev/sdb1               /media/stick    auto            noauto,rw,users,exec,umask=0077 0 0

/dev/sdc1               /media/stick2   auto            noauto,rw,users,exec,umask=0077 0 0
```

When I mount the device it is showing the following files:

```
ll /media/stick

total 103618

drwx------ 2 joseph joseph     2048 Aug 27  2007 bios

drwx------ 2 joseph joseph     2048 Aug 27  2007 custom

-rwx------ 1 joseph joseph 48496977 Aug 27  2007 kernel.bin

-rwx------ 1 joseph joseph        0 Aug 27  2007 skin0000.asus.mockup05

-rwx------ 1 joseph joseph   268092 Aug 27  2007 skin0000.bin

-rwx------ 1 joseph joseph       72 Aug 27  2007 skin0000.idx

-rwx------ 1 joseph joseph        0 Aug 27  2007 splash.top

-rwx------ 1 joseph joseph 10485760 Jul 24  2007 user-000.dat

-rwx------ 1 joseph joseph       15 Jul 24  2007 user-000.dat.date

-rwx------ 1 joseph joseph       36 Jul 24  2007 user-000.dat.md5

-rwx------ 1 joseph joseph 10485760 Jul 24  2007 user-001.dat

-rwx------ 1 joseph joseph       15 Jul 24  2007 user-001.dat.date

-rwx------ 1 joseph joseph       36 Jul 24  2007 user-001.dat.md5

-rwx------ 1 joseph joseph   327680 Aug 27  2007 va-config.sq

-rwx------ 1 joseph joseph 16551936 Aug 27  2007 va-ff.sq

-rwx------ 1 joseph joseph 17969152 Aug 27  2007 va-sk.sq

-rwx------ 1 joseph joseph  1482752 Aug 27  2007 va-splashtophelp.sq

-rwx------ 1 joseph joseph    20480 Aug 27  2007 va-zenv.sq

-rwx------ 1 joseph joseph        0 Aug 27  2007 va.config-dvm-0.1-20070827.ver

-rwx------ 1 joseph joseph        0 Aug 27  2007 va.firefox-2.0.0.3-dvm-0.1-20070827.ver

-rwx------ 1 joseph joseph        0 Aug 27  2007 va.firefox.splashtophelp-2.0.0.3-dvm-0.1-20070827.ver

-rwx------ 1 joseph joseph        0 Aug 27  2007 va.skype-1.3.0.53-dvm-0.1-20070827.ver

-rwx------ 1 joseph joseph        0 Aug 27  2007 va.zenv-dvm-0.1-20070827.ver

```

I don't recognize any of these files, I've never used skype.

How is it happening that external device is mounted without anything plugged into the USB port.

I only have USB scanner and USB serial device (to which UPS is plug IN).

Am I hacked?Last edited by Joseph_sys on Sun Aug 01, 2010 2:15 am; edited 1 time in total

----------

## Joseph_sys

Strange. I rebooted the computer, physically turning the power OFF/ON and the mysterious mounting device is gone.

Don't know what to think about it.

I've run: 

rkhunter --checkall --createlogfile --propupd

but everything is clean except few warnings: 

```
/usr/bin/ldd                                             [ Warning ]

/usr/bin/whatis                                          [ Warning ]

/usr/bin/lwp-request                                     [ Warning ]
```

chkrootkit - is getting stuck on php files :-/

----------

## Hu

I suppose you did not copy files from the mysterious mount point before rebooting?  Did you stat -f the mounted filesystem?  Run lsusb?

----------

## Sadako

Looking at some of the filenames, looks like your motherboard has Splashtop available on embedded flash memory, which is somehow being recognized and automatically mounted (what auto mount daemons, if any, are you running)?

Also, check what `modprobe -l | grep mtd` returns, which I'm guessing is the device driver used to access such flash, and see if lsmod lists such a module loaded.

Check the specs for your system, and unless Splashtop isn't listed I wouldn't be so concerned.

----------

## Joseph_sys

 *Hu wrote:*   

> I suppose you did not copy files from the mysterious mount point before rebooting?  Did you stat -f the mounted filesystem?  Run lsusb?

 

No I did not run "stat -f" the lsusb return nothing suspicious

```
 Bus 008 Device 002: ID 045e:0039 Microsoft Corp. IntelliMouse Optical

Bus 008 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

Bus 006 Device 002: ID 0711:0230 Magic Control Technology Corp. MCT-232 Serial Port

Bus 006 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

Bus 002 Device 002: ID 04b8:011b Seiko Epson Corp. Perfection 2400 Photo

Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Bus 007 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

Bus 001 Device 002: ID 0b05:1742 ASUSTek Computer, Inc. 802.11n Network Adapter

Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
```

----------

## Joseph_sys

 *Sadako wrote:*   

> Looking at some of the filenames, looks like your motherboard has Splashtop available on embedded flash memory, which is somehow being recognized and automatically mounted (what auto mount daemons, if any, are you running)?
> 
> Also, check what `modprobe -l | grep mtd` returns, which I'm guessing is the device driver used to access such flash, and see if lsmod lists such a module loaded.
> 
> Check the specs for your system, and unless Splashtop isn't listed I wouldn't be so concerned.

 

I'm not running any auto-mount daemons except "hald" rc-update show

```
           alsasound | boot

             apache2 |      default

             apcupsd |      default

            asterisk |      default

            bootmisc | boot

             checkfs | boot

           checkroot | boot

               clock | boot

         consolefont | boot

               cupsd |      default

            ddclient |      default

                hald |      default

            hostname | boot

             hylafax |      default

             keymaps | boot

               local |      default nonetwork

          localmount | boot

             modules | boot

               mysql |      default

            net.eth0 |      default

              net.lo | boot

            netmount |      default

             portmap |      default

             postfix |      default

      postgresql-8.4 |      default

           rmnologin | boot

               samba |      default

                sshd |      default

           syslog-ng |      default

      udev-postmount |      default

             urandom | boot

          vixie-cron |      default

                 xdm |      default
```

"modprobe -l | grep mtd" is not returning anything.

It could be that during reboot I somehow triggered Splashtop, I have ASUS P5E3 MB and apparently it comes with Splashtop.  But how did I trigger it?  

I would like to repeat the process to make sure it is it :-/

----------

## Joseph_sys

I was looking at the Asus Splashtop page:

http://www.neoseeker.com/Articles/Hardware/Reviews/asus_p5e3_deluxe/3.html

My motherboard does not show any splash when I boot; in addition I had some strange directory USB in my home "/home/joseph/usb" it appear to have some root file system but I remove it. I have no clue how it was created.

----------

## krinn

well, don't ask for clues if you keep deleting anything without looking at it first.

And the splashtop@asus is name ASUS Express Gate

http://www.youtube.com/watch?v=MQomsxBrcnw (and don't do like him, take 5s more to wash your hands !)

http://event.asus.com/mb/expressgate/

----------

## Joseph_sys

 *krinn wrote:*   

> well, don't ask for clues if you keep deleting anything without looking at it first.
> 
> And the splashtop@asus is name ASUS Express Gate
> 
> http://www.youtube.com/watch?v=MQomsxBrcnw (and don't do like him, take 5s more to wash your hands !)
> ...

 

Most of those files in /dev/sdb1 were binary files, so there was nothing to look at.

My splashtop does not come up during booting as system I had an upgraded bios before I got it so Splashtop wasn't working (no do I need it).  

Now, I'm just trying to duplicate this process.

----------

## BitJam

I got Splashtop working in my ASUS mobo.  It is just a big PITA IMO.  Anyway here are the files from /$MOUNT_POINT/ASUS.SYS/:

```
total 159602

-rwxrwxrwx 1 root root   268092 Dec  2  2009 10000010.bin*

-rwxrwxrwx 1 root root      100 Dec  2  2009 10000010.idx*

-rwxrwxrwx 1 root root   268092 Dec  2  2009 10000100.bin*

-rwxrwxrwx 1 root root      100 Dec  2  2009 10000100.idx*

-rwxrwxrwx 1 root root   268092 Dec  2  2009 10000110.bin*

-rwxrwxrwx 1 root root      100 Dec  2  2009 10000110.idx*

-rwxrwxrwx 1 root root   268092 Dec  2  2009 20000010.bin*

-rwxrwxrwx 1 root root      100 Dec  2  2009 20000010.idx*

-rwxrwxrwx 1 root root  2193930 Dec  2  2009 CE.CEX*

-rwxrwxrwx 1 root root   104038 Dec  2  2009 CEFULL*

-rwxrwxrwx 1 root root   105574 Dec  2  2009 CE_BZ*

-rwxrwxrwx 1 root root   376832 Dec  2  2009 SplashtopDll.dll*

-rwxrwxrwx 1 root root   225954 Dec  2  2009 bs-apache.sqx*

-rwxrwxrwx 1 root root  2949820 Dec  2  2009 bs-boxtool.sqx*

-rwxrwxrwx 1 root root  8213160 Dec  2  2009 bs-font1.sqx*

-rwxrwxrwx 1 root root  2769568 Dec  2  2009 bs-gtk.sqx*

-rwxrwxrwx 1 root root 35361434 Dec  2  2009 bs-kde.sqx*

-rwxrwxrwx 1 root root  3363498 Dec  2  2009 bs-locale.sqx*

-rwxrwxrwx 1 root root    21162 Dec  2  2009 bs-persist.sqx*

-rwxrwxrwx 1 root root  6275740 Dec  2  2009 bs-php5.sqx*

-rwxrwxrwx 1 root root  9331370 Dec  2  2009 bs-pyeng.sqx*

-rwxrwxrwx 1 root root  8450730 Dec  2  2009 bs-scim.sqx*

-rwxrwxrwx 1 root root  2663084 Dec  2  2009 bs-tinyx.sqx*

drwxrwxrwx 1 root root        0 Dec  2  2009 custom/

drwxrwxrwx 1 root root        0 Dec  2  2009 help/

-rwxrwxrwx 1 root root 23552258 Dec  2  2009 kernel.bin*

drwxrwxrwx 1 root root     4096 Dec  2  2009 persist/

-rwxrwxrwx 1 root root   268092 Dec  2  2009 skin0000.bin*

-rwxrwxrwx 1 root root      100 Dec  2  2009 skin0000.idx*

-rwxrwxrwx 1 root root   268092 Dec  2  2009 skin0001.bin*

-rwxrwxrwx 1 root root      100 Dec  2  2009 skin0001.idx*

-rwxrwxrwx 1 root root   268092 Dec  2  2009 skin0002.bin*

-rwxrwxrwx 1 root root      100 Dec  2  2009 skin0002.idx*

-rwxrwxrwx 1 root root   268092 Dec  2  2009 skin0003.bin*

-rwxrwxrwx 1 root root      100 Dec  2  2009 skin0003.idx*

-rwxrwxrwx 1 root root   268092 Dec  2  2009 skin0004.bin*

-rwxrwxrwx 1 root root      100 Dec  2  2009 skin0004.idx*

-rwxrwxrwx 1 root root   268092 Dec  2  2009 skin0005.bin*

-rwxrwxrwx 1 root root      100 Dec  2  2009 skin0005.idx*

-rwxrwxrwx 1 root root   268092 Dec  2  2009 skin0006.bin*

-rwxrwxrwx 1 root root      100 Dec  2  2009 skin0006.idx*

-rwxrwxrwx 1 root root        0 Dec  2  2009 splash.top*

-rwxrwxrwx 1 root root    17074 Dec  2  2009 va-915resolution.sqx*

-rwxrwxrwx 1 root root    90900 Dec  2  2009 va-aboutbox.sqx*

-rwxrwxrwx 1 root root   860856 Dec  2  2009 va-asusutility.sqx*

-rwxrwxrwx 1 root root   422562 Dec  2  2009 va-automount.sqx*

-rwxrwxrwx 1 root root  1512110 Dec  2  2009 va-config.sqx*

-rwxrwxrwx 1 root root  1987252 Dec  2  2009 va-fileaccess.sqx*

-rwxrwxrwx 1 root root 13898436 Dec  2  2009 va-firefox.sqx*

-rwxrwxrwx 1 root root     4816 Dec  2  2009 va-fsearch.sqx*

-rwxrwxrwx 1 root root  1762010 Dec  2  2009 va-help.sqx*

-rwxrwxrwx 1 root root   119498 Dec  2  2009 va-langpack1.config.sqx*

-rwxrwxrwx 1 root root    17094 Dec  2  2009 va-langpack1.fileaccess.sqx*

-rwxrwxrwx 1 root root  1516232 Dec  2  2009 va-langpack1.firefox.sqx*

-rwxrwxrwx 1 root root   656068 Dec  2  2009 va-langpack1.pidgin.sqx*

-rwxrwxrwx 1 root root   164552 Dec  2  2009 va-langpack1.skype.sqx*

-rwxrwxrwx 1 root root  5874338 Dec  2  2009 va-photo.sqx*

-rwxrwxrwx 1 root root     8892 Dec  2  2009 va-pidgin.help.sqx*

-rwxrwxrwx 1 root root  6058678 Dec  2  2009 va-pidgin.sqx*

-rwxrwxrwx 1 root root     8934 Dec  2  2009 va-prefs.sqx*

-rwxrwxrwx 1 root root 17879734 Dec  2  2009 va-skype.sqx*

-rwxrwxrwx 1 root root  1053390 Dec  2  2009 va-theme-bioblu.sqx*

-rwxrwxrwx 1 root root   426702 Dec  2  2009 va-theme-mirage.sqx*

-rwxrwxrwx 1 root root    21164 Dec  2  2009 va-zenv.sqx*

-rwxrwxrwx 1 root root     5312 Dec  2  2009 version*
```

As others have said, ISTM the mysterious files that showed up were from an earlier version of Splashtop.  I have no idea where those files are residing though.  On my system I created an ntfs-3g partition and manually installed the files but I don't remember where from.

I think it is highly unlikely that the mysterious appearance was due to someone breaking into the machine.  I agree with the theory that the mobo has some sort of built-in flash memory that somehow showed up as usb drives.  My Splashtop has also misbehaved.  I had some trouble with Slim and Nvidia drivers on an antiX install that got the system jammed up so it would only boot into Splashtop.  I think I had to unplug the hard drive just to be able to get into the BIOS settings and straighten things out.

----------

## Joseph_sys

Thanks for the input.  The files look very alike but yours are from 2009 mine are from 2007; so I guess there is no reason for panic :-/

----------

## Joseph_sys

 *Hu wrote:*   

> I suppose you did not copy files from the mysterious mount point before rebooting?  Did you stat -f the mounted filesystem?  Run lsusb?

 

That device mounts again.  Running:

```
stat -f /dev/sdb1

  File: "/dev/sdb1"

    ID: 0        Namelen: 255     Type: tmpfs

Block size: 4096       Fundamental block size: 4096

Blocks: Total: 2560       Free: 2487       Available: 2487

Inodes: Total: 1024504    Free: 1021930

modprobe -l | grep mtd

 return nothing

lsmod

Module                  Size  Used by

vboxnetadp              4976  0

vboxnetflt             11200  0

vboxdrv              1706732  2 vboxnetadp,vboxnetflt

scsi_wait_scan          1424  0
```

----------

## Hu

 *Joseph_sys wrote:*   

> That device mounts again.  Running:
> 
> ```
> stat -f /dev/sdb1
> 
> ...

 You stat'd the device node, not the filesystem.  Look up where the files are exposed and stat -f that.

----------

## Joseph_sys

 *Hu wrote:*   

>  *Joseph_sys wrote:*   That device mounts again.  Running:
> 
> ```
> stat -f /dev/sdb1
> 
> ...

 

I see, so it will be /media/stick and it gives me:

```
stat -f /media/stick

  File: "/media/stick"

    ID: 81100000000 Namelen: 260     Type: msdos

Block size: 2048       Fundamental block size: 2048

Blocks: Total: 61862      Free: 8490       Available: 8490

Inodes: Total: 0          Free: 0
```

----------

