Formatting a USB device changes the contents of that drive, but it does not automatically remove persistence mechanisms on the computer. In chains similar to those studied in MAYUNDO testing, the problem can return when another device is connected.
Where the source may be
Windows may contain a startup entry invoking a suspicious script or other component. While that source remains active, cleaning or replacing a USB drive may not break the chain. Formatting can also destroy documents that might otherwise be recoverable.
How to investigate safely
Avoid opening unexpectedly created shortcuts. Disconnect nonessential external devices, preserve important data and scan Windows as well as the USB drive. Compare the system findings with those from the removable device before taking action.
What was validated
In V1.6.3 MAYUNDO testing, remediation removed the observed RunHelper persistence and associated artifacts. Subsequent rescans found no known indicators from those specific scenarios.
When to reconnect the USB
Reconnect the device only after checking the computer. If the behavior returns, treat it as a new incident: retain the report, avoid launching shortcuts and investigate the process recreating those files.
Related reading
- MAYUNDO and RunHelper: understanding Windows persistence
- Windows ↔ USB reinfection: understanding a MAYUNDO-related chain
A safer scan with ANTÍDOTO
If you recognize these symptoms, you can download ANTÍDOTO and run a free scan of Windows and external devices. Review the findings before deciding on remediation, which requires a license. See the licensing plans and Resource Center. Detections and outcomes depend on the individual case.