How to remove Virus from USB Drives
One of the ways by which a virus can infect your PC is through USB/Pen drives. Common viruses such as ’Ravmon’ , ‘New Folder.exe’, ‘Orkut is banned’ etc are spreading through USB drives. Most anti virus programs are unable to detect them and even if they do, in most cases they are unable to delete the file, only quarantine it. Here are the things which you can do if you want to remove such viruses from your USB drives
Whenever you plug a USB drive in your system, a window will appear similar to the one shown below
Don’t click on Ok , just choose ‘Cancel’. Open the Command Prompt by typing ‘cmd‘ in the run box. In the command prompt type the drive letter: and press enter . Now type dir /w/a and press enter.
This will display a list of the files in the pen drive. Check whether the following files are there or not
- Autorun.inf
- Ravmon.exe
- New Folder.exe
- svchost.exe
- Heap41a
- or any other exe file which may be suspicious.
If any of the above files are there, then probably the USB drive is infected. In command prompt type attrib -r -a -s -h *.* and press enter. This will remove the Read Only, Archive, System and hidden file attribute from all the files. Now just delete the files using the command del filename. example del Ravmon.exe. Delete all the files that are suspicious. To be on a safer side, just scan the USB drive with an anti virus program to check whether it is free of virus or not. Now remove the drive and plug it again. In most of the cases, the real culprit turns out to be the “Autorun.inf” file which mostly gets executed when someone clicks Ok in the dialog window which appears above. Thus the infections can spread
Security Tip
Disable the Autoplay feature of USB drives. If you disable the Autoplay feature of USB drives, then there are lesser chances of the virus spreading. A tool which can perform such a function is Tweak UI. Download it from here install it.
Run the program. Now you can disable the Autoplay feature of the removable drives as shown above. By following the above steps, you can keep your USB drives clean. If there are any other methods which you use, then share it with me through comments.
First thank you very much but i can’t remove the virus .I read it and tray to remove but it dosn’t rmove please if you have other semple way hellp me . I have doucoments in my USB SO PLEASE.
There is a backdoor bot in my pendrive that creates a folder named RECYCLER which has a sub folder. This subfodler contains a copy of the spoolsv.exe.
Now my system is infected. How can this be removed?
Thanks friend ,
you made my job easier…..
Thanks again ……:)
Many Thanks for the useful info – helped me clear my ipod of autorun.inf & svchost.exe
Thank you for your assistance Sir Madhur Kapoor. Am now able to remove these nugging viruses from my PCs. Thank you for sharing your knoeledge. In IT no one is the best we learn through sharing. IT is a dynamic and diverse field of study thus we should learn from each other. If I get something new I’ll share it with you.
My IPOD is not read by any computer. Some one can help me. It can be virus, but how can i remove while not reading.
attrib -r -a -s -h *.* command does not work, I’m using XP.It says the command is not recpgnized
Hello,
I recently got an attack of kinza.exe. My usb drive has no files at all(no hidden files, I am sure, for ‘view hidden file’ is always enabled). The USB was completely blank after a previous quick format. Yesterday when I inserted it into my pc it took very long than usual to open. After It opened i found kinza.exe and autorun.ini automatically created. And my antivirus program reporting a virus on usb. But it could not delete the files. I tried to delete manually in normal mode but without any success.
Later I deleted files from RHEL5 and thought it is removed from the system. So feeling safe I inserted my iPod nano and alas; it got infected too. That means my pc is already infected with the virus.
Can you please tell me what is the source of kinza.exe? is it internet? if so what sort of sites? adult sites?
The pc I use is a shared pc installed at work place.I found somebody has accessed some x-rated adult sites from that pc. can this be a cause?
The virus causing lot of problem for I need to carry work-stuff to home via pen-drive every day.
Can you please suggest how to get rid of kinza.exe and what precautions to be taken so that this does not happen again.
Many thanks in advance
Thanks so much
Hey!!!
The one of the best way to keep virus away from your PC through your pen drive is, Juss neglate the Autorun option(i.e. cancel ).Open my computer.After that right click on your pen drive Drive and select explorer which list the file inside your pen drive and if the hidden file till hidden then go to <> <> <> select <> click <> . Now it show the hidden files on your pen drive(i.e. virus usually stay in hidden form). Juss select the suspicious file and Press Shift+Del for deleting the virus from your pen drive.This is a manual process for remove viruses from your pen drive.
ENJOY!!!!!!