I’m sorry for such a question, which can seem to be moronic, but probably somebody knows the quick and valid answer.
So:
- USB flash drive is inserted to the computer
- it was never ever inserted to this computer before
- AutoPlay is disabled in Control Panel
- NoDriveTypeAutoRun is NOT set
- after the USB flash is inserted, the WUDFHost.exe process is started as Local Service, which starts to read all files on the USB flash (visible in the out-of-the-box Resource Monitor - the button in TaskMgr).
- also, wmplayer.exe is started, without any UI shown.
- when the same drive is inserted the second time, WUDFHost.exe is still started and running, but does not do anything. wmplayer.exe is also started for a brief moment and exits ASAP.
- you eject the USB flash - WUDFHost exits.
Is it legitimate? or malware?
I see some new devnode called “Flash disk” in devmgmt, of the class of “Portable Devices”, serviced by UMDF, and a child of UMBus stuff. Also this same string of “Flash Disk” appears in the Windows Media Player UI, if you start it manually.
Is the WUDFHost.exe which is started by flash drive insert - related to this devnode? so, it can be legitimate?
For me, this is a surprise that the flash drive is not only USBSTOR’s block disk device devnode, but also some “Portable Device”.
I’ve heard on some “WPD”, but I know nothing on it except it is implemented by UMDF.
What is WPD? is it legitimate for Windows Media Player to read all files on a newly inserted flash drive being a client of this WPD interface, serviced by the UMDF host? is it legitimate for the UMDF host for WPD to access the files on a flash drive?
I’m sorry once again, but it is alarming if some processes are started on flash drive insert, especially if this process is reading all of the files on the flash, doing 0.5GB in rather short time.
Is it legitimate behavior of WPD (again - what is it? and how is it related to a block device? is it also related to Windows Phone? or maybe iOS device in the absence of Apple’s driver?) and WMPlayer using WPD?
–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com