How to remove Virus from USB Drives
One of the ways by which a virus can infect your PC is through USB/Pen drives. Common viruses such as ’Ravmon’ , ‘New Folder.exe’, ‘Orkut is banned’ etc are spreading through USB drives. Most anti virus programs are unable to detect them and even if they do, in most cases they are unable to delete the file, only quarantine it. Here are the things which you can do if you want to remove such viruses from your USB drives
Whenever you plug a USB drive in your system, a window will appear similar to the one shown below
Don’t click on Ok , just choose ‘Cancel’. Open the Command Prompt by typing ‘cmd‘ in the run box. In the command prompt type the drive letter: and press enter . Now type dir /w/a and press enter.
This will display a list of the files in the pen drive. Check whether the following files are there or not
- Autorun.inf
- Ravmon.exe
- New Folder.exe
- svchost.exe
- Heap41a
- or any other exe file which may be suspicious.
If any of the above files are there, then probably the USB drive is infected. In command prompt type attrib -r -a -s -h *.* and press enter. This will remove the Read Only, Archive, System and hidden file attribute from all the files. Now just delete the files using the command del filename. example del Ravmon.exe. Delete all the files that are suspicious. To be on a safer side, just scan the USB drive with an anti virus program to check whether it is free of virus or not. Now remove the drive and plug it again. In most of the cases, the real culprit turns out to be the “Autorun.inf” file which mostly gets executed when someone clicks Ok in the dialog window which appears above. Thus the infections can spread
Security Tip
Disable the Autoplay feature of USB drives. If you disable the Autoplay feature of USB drives, then there are lesser chances of the virus spreading. A tool which can perform such a function is Tweak UI. Download it from here install it.
Run the program. Now you can disable the Autoplay feature of the removable drives as shown above. By following the above steps, you can keep your USB drives clean. If there are any other methods which you use, then share it with me through comments.
I got this exe in my thumb drive named Shahrokh.exe along with 2 hidden files named autorun.exe and autorun.inf
If I delete these files, they get created again. How can i heal my infected drive?
PS: The Task Manager is disabled and making changes in the registry to enable it does not work.
i’ll make a tagalog version of your article for my friends…
…
BTW tweakUI can also be found on microsoft download center. It is a part of the Windows Xp powertoys
nice work dude!!!
can u tell me how remove {trojan} virus permanently….from my p-c,,its creating problem and could not be deleted by my anti virus{bit-defender}0:-
Thanks Madhur,
I’ve used a few antivirus programmes on different machines which detect a virus on my USB device, but never get rid of it. Hours of rumaging around on their websites revealed no informaton as to how to remove the damn thing. After reading your site, it took a couple of minutes to remove an autorun.inf file.
Keep up the good work!
[...] and the english version:http://www.whoismadhur.com/2008/01/26/how-to-remove-virus-from-usb-drives/ Technorati tags: usb virus, remove ravmon, remove virus from [...]
[...] to remove Virus from USB Drives One of the ways by which a virus can infect your PC is through USB/Pen drives. Common viruses such as ’Ravmon’ , ‘New [...]
i tried alll the said method to remove MicrosoftPowerPoint.exe from my pen drive but its still there and cmd says could not find MicrosoftPowerPoint.exe. kindly sugest me how to remove this.
Also when ever i scan my system with AVG. if virus found that perticular folder changes its attributes and i will found it only when to burn any cd.
OMG thank you soooo much!!! Your article really helped! The USB virus gave me such a headache when it infected my portable hardrive! I was beginning to think there’s no hope for saving it. But luckily I found this!!!
Thanks heaps.
[...] know how to do this? My friend Madhur shows you how to disable the USB autorun feature manually or using Microsoft’s Tweak UI [...]
gr8 stuff daa,thanks !