Spectrum analyser virus

[Richard Head]

I have been using an Agilent N9320 Spectrum analyser and regularly download screenshots from it. A couple of days ago I used a spare flash drive that was lying around the office to transfer the files from the SA to the PC. The transfer to the stick went, however when I tried to copy them to the PC I encountered a problem. When I clicked on the E: drive it brought up all the files (.jpg) as expected but then before my eyes some of the files started disappearing! I could open the remaining files with no problem but some files had disappeared permanently. I suspected that there was a virus on the flash drive so formatted it on the same PC.
I then plugged the stick into the SA and tried to re-copy the files again but now the SA can't see the flash drive at all. When I tell it to copy a file it says it can't see a USB drive.
I tried another brand new formatted and tested flash drive into the SA and it can't see that one either. It seems like the SA might have a virus! Note that the SA doesn't run an OS as far as I know. It is a new but bottom of the range unit. 
How do I get the USB port on the SA working again? I'm waiting for Agilent to get back to me.

[Whales]

I used a spare flash drive that was lying around the office

Other possibilities:

• The USB stick is faulty.  Try another
• The OS on your computer and the spectrum analyser are having filesystem interoperability issues.  It should be formatted as FAT32/FAT16/etc, not exfat or ntfs.
• Malware was on the drive from before you put it into the spectrum analyser.

Indeed it is highly unlikely that malware exists to exploit your spectrum analyser.  It's more than possible, but I doubt it exists "in the wild".

None the less, consider some AV software if you don't already have some.  Many free and paid options exist.

[Richard Head]

Whales

Thanks for the prompt reply.
I tried another brand new formatted and tested flash drive into the SA and it can't see that one either.
I tried that. The SA can't see either.
•Malware was on the drive from before you put it into the spectrum analyser.
This seems the most likely to me. I agree that the virus certainly wasn't designed to target test equipment, just incidental!
I'll have to think about what to do regarding your other suggestions. Thanks

[nctnico]

Maybe the connector went bad or the USB sticks are flaky el-cheapo ones. I recently got a cheap USB stick (gift) but that didn't work reliable so it went into the bin. I'd try one of the higher end Kingston USB sticks.

[Richard Head]

ntcnico
I'll try a third "known good"stick.

[PA0PBZ]

Did you format the stick as FAT? Otherwise chances are that it will not be recognized.
A virus seems unlikely, it looks like this analyser runs Linux and there are not too many viruses for that. If your PC runs on windows it is even more unlikely that a Linux virus was transferred via a Windows PC.

[Wuerstchenhund]

I have been using an Agilent N9320 Spectrum analyser and regularly download screenshots from it. A couple of days ago I used a spare flash drive that was lying around the office to transfer the files from the SA to the PC. The transfer to the stick went, however when I tried to copy them to the PC I encountered a problem. When I clicked on the E: drive it brought up all the files (.jpg) as expected but then before my eyes some of the files started disappearing! I could open the remaining files with no problem but some files had disappeared permanently. I suspected that there was a virus on the flash drive so formatted it on the same PC.

I have to say it's really not a very bright thing to plug some unknown USB stick that "was lying around the office" into anything, really. The stick could have easily been infected with malware and left there intentionally, and your thoughtlessness could have easily compromised your office's network, which certainly would have resulted in very uncomfortable consequences for your career.

This aside, you didn't even know if the stick was formated, and if so, in what format, so you can't even know if the stick actually could have worked with your SA.

However, as to disappearing files, that isn't necessarily the sign of a virus (or any malware in general, as viruses are pretty rare these days), it can very well be a sign that the stick is on its way out or that the file system has been corrupted. I've actually seen a similar effect with sticks that were at the end of their life.

I then plugged the stick into the SA and tried to re-copy the files again but now the SA can't see the flash drive at all. When I tell it to copy a file it says it can't see a USB drive.

Another hint that could point to a defective USB stick.

I tried another brand new formatted and tested flash drive into the SA and it can't see that one either.

What file system was the this stick formatted with? Just because it's formatted doesn't mean it'll work in your SA. Most newer sticks come preformatted in exFAT, and people often reformat them in NTFS, all which your SA can't read.

It seems like the SA might have a virus! Note that the SA doesn't run an OS as far as I know. It is a new but bottom of the range unit.

The N9320 is pretty old (approx 8-9yrs) the N9320B is the (slightly improved) successor which is still sold, and both actually do run a OS, which as far as I remember is Linux (with the software written in Java).

However, it's highly unlikely it catched a virus. quite frankly this reads more like a case of flakey hardware and user error.

How do I get the USB port on the SA working again?

For a start, try to get your hands on some working(!) USB sticks with 2GB or less. Then format them with FAT32 (with standard sector size!), and try again. I wouldn't be surprised if at least some work just fine.

The problem with test instruments is that (aside form those instruments running Windows) USB support generally sucks. Most of the non-Windows instrument require FAT32, many with a certain sector size, and lots of instruments are even limited to what size the USB stick can be (often something like 2GB or less). And even iof you have a USB stick of the right size and formatted in the right way it might still not work because of some incompatibility with that specific stick.

In addition, these days the market is flooded with fake USB sticks that are claimed to have 4GB, 8GB, 16GB 32GB or more storage capacity, but actually contain somewhere around 1GB plus a specific firmware that fools the OS into thinking this is actually a much larger stick. And it's not just non-name sticks that are affected, even if you buy a brand name stick from a reputable source you can't be 100% sure that you're not getting a fake. Obviously, fakes won't work very well with your SA, too.

[videobruce]

Have you considered that port just being bad??

[HighVoltage]

I have noticed that also the brand of the USB flash drive can matter.
On one older instrument I only got a "Flash Voyager" drive from Corsair to work, 2 GB and FAT formatted.
This USB drive seems to work really well on older PCs.

[wraper]

I have to say it's really not a very bright thing to plug some unknown USB stick that "was lying around the office" into anything, really.

http://kukuruku.co/hub/diy/usb-killer

[Wuerstchenhund]

I have to say it's really not a very bright thing to plug some unknown USB stick that "was lying around the office" into anything, really.

http://kukuruku.co/hub/diy/usb-killer

That's an interesting project 

Although I'd say that 'just' destroying the USB controller on a PC is still the lesser evil, compared with compromising a corporate network which potentially could also include the loss of sensitive data.

[ConKbot]

The agilent spec an is just a Windows machine and should handle any drive a Windows machine can. Plug an a keyboard and mouse and treat accordingly. Worst case scenario, use the recovery partition to nuke it from orbit if it's the only way to be sure.

Obviously try a known good and clean drive in all the usb ports, see if anything shows up in device mangler, and disk management, and if you have to, install an antivirus at least temporarily to clean it. If you can get it to boot off of an external drive and use a recovery tool instead of installing it on the instrument.

[Richard Head]

Thanks to all for the responses.
The stick in question is one that I have used many times before on the instrument. It's sort of a communal engineering dept. stick! I'm not sure how its formatted but it has worked on the instrument many times in the past.
The virus theory is just a guess and perhaps incorrect. The fact is that the stick still works on the PC but not on the instrument USB port. Perhaps the fault is a hardware problem on the port.

[Wuerstchenhund]

The agilent spec an is just a Windows machine and should handle any drive a Windows machine can.

What makes you think the N9320 runs Windows?

[ConKbot]

The agilent spec an is just a Windows machine and should handle any drive a Windows machine can.

What makes you think the N9320 runs Windows?

The fact that a lot of the Agilent RF test gear is windows based. The E5071 VNAs, N90x0 series VSAs, are all windows based, and the N9320B is of the same generation, so I dont see why they would vary from that. It should pretty easy to tell on boot, or by plugging in a keyboard/mouse and alt-tabbing out of the test instrument application.

[Wuerstchenhund]

What makes you think the N9320 runs Windows?

The fact that a lot of the Agilent RF test gear is windows based.

As a lot of Agilent RF test gear runs VxWorks and Linux. Actually, you'll find that it's mostly some upper mid-range and high end kit that runs Windows, the most of rest relies on VxWorks and Linux (although a few devices like the DSOX Series of scopes run on WindowsCE).

The E5071 VNAs, N90x0 series VSAs, are all windows based, and the N9320B is of the same generation, so I dont see why they would vary from that.

That's a pretty over-simplistic way to look at it. The VSA and VNA Series is a completely different level, not just in price, while the N9320 is essentially a simple compact "low cost" (well, for Keysight's definition) benchtop spectrum analyzer. Drawing conclusions from expensive instruments and assuming that the same will be valid for "economy" devices just because it's from around the same time frame is pretty useless.

BTW, I just checked, the N9320 actually runs VxWorks (like many of Agilent's test instruments), so the file system support and USB drive compatibility will be even worse than if it ran Linux.

[jlmoon]

Thanks to all for the responses.
The stick in question is one that I have used many times before on the instrument. It's sort of a communal engineering dept. stick! I'm not sure how its formatted but it has worked on the instrument many times in the past.
The virus theory is just a guess and perhaps incorrect. The fact is that the stick still works on the PC but not on the instrument USB port. Perhaps the fault is a hardware problem on the port.

ESD Damage to SA port while inserting stick into port?

[Richard Head]

ESD Damage to SA port while inserting stick into port?
Not out of the question I suppose. The failure wasn't a sudden event like I expect ESD would produce. That's why I suspected a virus.
 

[donmr]

Do you have some sort of photo management program on your PC that is grabbing the JPEG files and moving them into its area?  I have seen ones that do this, you connect a camera (which often is just a USB mass storage device) and it grabs the photos off the "camera".

[dj831]

Hi everyone,

I've just purchased an N9320B off eBay, and had the exact same issue, unable to 'copy' files to drive ... There were 3 files stored in the internal memory of the device, and I wanted to save them, but whatever key I inserted, got error 764: unable to save file. Argh ...

This is now solved, and had nothing to do with a virus, or a defective USB port. For those having that same issue, here is how I solved my issue:

-1. Ensure that USB port of the N9320B is not defective. Find an USB drive with a LED (I used an Emtec 4Gb drive, red translucent for that). Then 'copy' a file without inserting your key. You have error 507 (no USB drive inserted), meaning that SA sees no device on USB port. Then insert your drive, LED must blink (as it would do when you insert your key in a PC), then 'copy' file again. LED blinks, and you get error 764, i.e. unable to write file. Sure, you are not 100% sure that port is defective, but it gives you basic information (LED turns on: you have power, and LED blinks when accessed: SA tries to access your drive).

-2. Clean your USB drive. I had a 'La Cie' USB key, brand new still in package, and SA was able to save data on it, despite garbage that was on it (La Cie utilities). 'Copy' was though not possible on the Emtec drive, 4Gb, despite formatting with Windows (W7, x64), either in FAT32 or even in FAT. To solve issue, I ran 'diskpart' command in cmd.exe, and cleaned the disk, formatted it with diskpart (and not with Windows Explorer). Now, it works fine.

These tips worked for me, I hope this could help you if you encounter the issue (issue poorly documented!).

Note: for those who are not familiar with Diskpart, here are commands to enter:

Start menu, type 'cmd.exe' then press enter. In the black box, similar to old DOS, type 'diskpart' (and accept security warnings - if prompted to do so). Diskpart opens:
DISKPART> list disk (identify correct drive, your USB key - VERY IMPORTANT!)
DISKPART> select disk [id] (id: number of your USB key - be careful to select your USB drive)
DISKPART> clean (if you selected wrong disk, you erase data of another disk - BE CARFUL!)
DISKPART> convert mbr
DISKPART> create partition primary
DISKPART> select part 1
DISKPART> active
DISKPART> format fs=FAT32
DISKPART> quit

[AlfBaz]

I think this is a problem I've seen before.

It appears the SA's firmware is assuming sector zero is a master boot record (MBR) and looking for the start of the volume within the MBR structure. Windows will format corrupt media without an MBR and place the start of the volume in sector zero instead. This means sector zero now has a Bios Parameter Block (BPB) instead of an MBR.

FDISK use to be the tool to use back in the day to get your MBR back but as dj831 has pointed out, now days it's DISKPART