In this article, we'll show you how easy and quick remove virus from USB stick... One of the most widespread families of viruses is Trojans, which are written to the boot system file autorun.inf... Files such as autorun.exe, autorun. ~ Ex, autorun.inf_ *** and other derivatives with even more dubious extensions after the dot can be a sign of their presence on the flash drive. The virus copies itself to the USB flash drive as soon as the flash drive is inserted into the USB connector.
The principle of the virus is as follows. Once in the system, it looks for all local drives and flash drives. After that, for each found source, two files are copied - autorun.inf and autorun.exe. In turn, autoran.inf contains the following lines:
And the autorun.exe file is executable and serves to propagate the virus on possible media. In reality, the executable file.exe can be called completely differently, for example cyvvefew.exe, that is, with an incomprehensible name.
Signs of a virus infection on a flash drive or memory card
The symptoms of Windows infection with such a virus are very diverse:
- the flash drive just won't open
- the left mouse button does not work
- in the explorer context menu instead of the name of the krakozyabra items.
- files on a flash drive may disappear
In general, do not overlook In fact, these viruses are more harmless than those that are. And you can catch them either without using an antivirus or from someone else's infected computer.
A direct indicator that a virus is present on the USB flash drive is the presence of a hidden RECYCLED or RECYCLER folder. There should not be such a folder on a flash drive.
If there is such a folder, then it probably contains the executable file of the virus ***. EXE.
Removing a virus from a USB flash drive manually
It is difficult for an ordinary user to detect a virus, since files have a system status, which means they are not displayed in the standard display of files in Windows. Enabling the display of hidden files and folders in Windows is simple. To do this, do the following:
Windows 7: Start -\u003e Control Panel -\u003e Folder Options -\u003e View tab -\u003e show hidden files, folders and drives
Windows XP: Start -\u003e Control Panel -\u003e Folder Options -\u003e View tab -\u003e show hidden files and folders
Some viruses of the Autorun family disable the ability to change this parameter. Nevertheless, if this option remains, then turn off the display and delete the specified files by searching for the word “autorun”.
Free Anti-Autorun antivirus helps you remove the virus
You can remove a virus from a flash drive simply by formatting it. Naturally, a complete system check will be necessary. Usually, such viruses do not block the computer or damage data, so their removal will not be so difficult. But there is also a more universal and simpler method.
You can use a specially designed anti-virus program called Anti-Autorun. You can find it in a search engine. With this program, it will not be difficult to remove a virus from a USB flash drive. This antivirus is an excellent solution for monitoring and fighting autoran viruses. Hope our recommendations helped.
Removable USB-devices for storing information in the form of the most common flash drives are susceptible to viruses no less than hard drives with operating systems installed on them. And often it is quite problematic to identify the presence of such a threat or to neutralize it. How to remove a virus from a flash drive and recover files (hidden or infected) will be discussed further. Several basic methods can be used for this. However, before using them, it is necessary to find out what the user is dealing with. As they say, you need to know the enemy by sight!
What viruses and how do they most often affect removable USB drives?
In general, there are not so many threats that most often settle on removable drives.
Most often, flash drives are affected by ransomware and Trojans, which simply hide files and folders from the user. However, this category of threats is, in general, the most harmless, since information in the physical sense is not destroyed and does not disappear from the carrier. Thus, instead of the usual picture with all the files and folders written to the drive, he sees either only the shortcuts that came from nowhere, or does not see anything at all.
Symptoms of the presence of an infection
It is quite simple to remove the virus, shortcuts and related components from the flash drive, which has settled there (we will dwell on this separately). But first, let's see how, in fact, determine that a virus has stuck on the drive. Please note right away that shortcuts may not always appear instead of files and directories. Sometimes access to the drive may be blocked due to the fact that the operating system does not see it. But this is rare. In the case when it is possible to view the contents of the flash drive, first of all, in the most ordinary "Explorer" from the view menu, turn on the display of hidden objects.
If there is a virus on the storage medium, as a rule, there will be an invisible Autorun.inf file, an executable EXE object, the name of which often consists of a meaningless set of letters and symbols, as well as a hidden RECYCLER folder (it may not always be present).
To be sure, before connecting the device to a computer or laptop, in the autorun section of the Control Panel, for removable media from the list, select the Do not take any action item, which will save you from the immediate penetration of the threat to the stationary device.
How to remove a virus from a USB flash drive using the simplest method?
First, consider the simplest solution that immediately comes to mind for all users without exception. Suppose that there is no important data on the removable device, the user does not need the files, and their copies or originals are on the hard disk or other media. How to remove a Trojan virus from a USB flash drive? Elementary! To do this, you just need to perform a complete formatting, for which even the standard tools of Windows systems are suitable.
Portable scanners
But let's see how to remove a virus from a flash drive without losing data, if the information stored on the media is extremely important. It is clear that the formatting option is clearly not suitable. So what do you do? You can, of course, try to delete several of the above objects yourself, but it is far from the fact that files and directories will be restored after infection (meaning that shortcuts are displayed instead). It is logical to assume that appropriate antivirus software should be used to neutralize the threat. And the best for this are not standard protection tools (although you can use them as well), but portable utilities, among which the most powerful are Dr. Web CureIt! and KVRT. Pay attention immediately to the settings of such programs. In them, the action to be performed upon detection of a virus should not be set to the deletion of infected objects, which may affect the user's important files, but, if possible, to disinfect.
How to remove a virus that creates shortcuts from a flash drive manually?
Now a few words about what can be done if there is no suitable tool at hand. How to remove a virus from a flash drive in this case? This will require manual intervention. Some users find this to be a very difficult and tedious procedure. But actually it is not. First of all, through the RMB menu, check the properties of some folder, which is shown as a shortcut. Here, on the tab of the shortcut, pay attention to the field "Object" - there may be a long path in which the name of the previously mentioned RECYCLER directory (or some other) may be entered with the addition of the name of the EXE file. Try to delete the specified folder yourself. If this turns out to be impossible, use the Unlocker utility. After that, just in case, go to the AppData directory of the user directory on the hard drive, then check the Roaming folder, since the virus can migrate there, and after deleting it from the removable media, make spontaneous copying to the USB flash drive again.
Actions on file and folder attributes
But that's only half the battle. How to remove the virus completely and completely from the flash drive so that the information will take its previous form? Now you will need to perform some actions with the attributes of hiding files and directories, which cannot be removed in the properties of any of these objects (the corresponding field with a check mark on it will be inactive and marked with gray color). In this case, you can use the most common "Notepad" to create an executable batch BAT file and enter the content shown in the image below as text.
You can do it even easier by using the tools of the Shell, which should be run as administrator. It contains two commands with pressing the enter key after each of them (we assume that the flash drive in the "Explorer" is designated by the letter "F"):
- cd / d f: \\;
- attrib -s -h / d / s.
Note: punctuation marks at the end after entering the commands shown are not needed!
Recovering media with third-party utilities
Finally, if you do not like or do not like the methods of deleting attributes and restoring information described above, you can use special third-party utilities.
If we talk about how to remove a virus from a flash drive in this case, a small USB Hidden Recovery program is a good choice, in which you first need to set a full scan and then perform a recovery.
If the flash drive was still formatted, no matter what they say, you can use the R-Studio application, the use of which may not give the desired result unless only in the case of low-level formatting.
Have you ever dealt with USB sticks infected with viruses? I'll tell you about myself. I work as a system administrator and maintain a computer network. Once, about 5 years ago, at work there was a case of infection of a computer network with a virus, which, by negligence, brought in one of the employees through an infected USB flash drive. This virus is also called "Avtoran" (we will dwell on it in more detail later). The antivirus program that was on the computer at that time missed it without detecting it in time. And even then, when treating the computer and removing this virus, it recovered itself! I had to disconnect all computers from the grid and cure each one using a boot disk. Here's a story.
Where am I leading this? And to the fact that it is better to "strangle" this computer worm even before it tries to get into the RAM of your computer. Now a small antivirus program "Sharp Eye" helps me with this task. We will talk a little later about how to use it and how to clean the USB flash drive from viruses.
What kind of beast is this Avtoran?
Who cares - a little theory about what Avtoran is. The word "autoran" (auturun) is translated as "autorun". This term means the automatic launch of certain types of files when any storage medium is connected to the computer, whether it is an external hard drive, USB Flash drive (flash drive), memory card, player, phone, etc. (in this article we will talk about USB flash drives, meaning all external storage media). This launch is initiated by the autorun.inf file located on the USB flash drive. The file itself was invented by Microsoft for a noble purpose - to simplify the work and reduce the number of user actions to open any program, video, music, images, etc. located on a USB flash drive. But this innovation played into the hands of the creators and distributors of the virus.
The easiest way to use the autorun.inf file to infect the system is to write the path to the file with the virus located on the same media in order to launch it automatically. The second method is to inject the virus code in text format directly into the autorun.inf file itself. There may be other ways to use this file for malicious purposes, but that's not the point. The point is that when a USB flash drive is connected to a computer, the infected autorun.inf file located on it automatically launches a virus into the computer's RAM, which in turn monitors new network drives or external drives in order to further replicate. Therefore, the main task of the user is to prevent the autorun.inf file from launching the virus by neutralizing it immediately after connecting the flash drive to the computer.
How to clean a USB flash drive from viruses without infecting your computer? The solution of the problem
It is interesting that disabling the autorun function of external devices in the system does not fundamentally solve the problem, since if you manually open the flash drive by double-clicking the mouse, autorun will still work. Antivirus programs also do not provide a 100% guarantee that all auto-run viruses will be detected. What, then, is the best protection against viruses on a USB flash drive and other storage media connected to a computer? The answer is a specialized utility from the Anti —autorun series, which instantly detects this type of virus and immediately neutralizes it even before it starts automatically. And just such a utility, as I mentioned at the beginning of the article, is the Sharp Eye program. 
This utility reliably protects your computer from viruses such as Trojans, Authors, Rootkits and Worms. It controls all autoruns and will be especially useful for those through whose computer a lot of flash drives pass, since they are the most common spread of viruses. Separately, I would like to note that the "Sharp Eye" program does not load the processor, and does not conflict with any other antivirus programs. Moreover, it does not have anti-virus databases and therefore does not need to be updated regularly. Its task is to track all autoruns and block them in time. If a trusted program falls under such a ban, it can be easily restored and added to the list of exclusions so that Sharp Eye will not react to it next time. And the best part is that this utility is absolutely free.
Program functions:
- autorun management;
- maintaining the history of autoruns;
- setting exceptions;
- the presence of quarantine;
- elimination of traces of the virus, such as: unlocking the task manager, registry editor, safe mode, restoring the Explorer menu and removing all its restrictions, fixing the taskbar, etc.;
- change of skin (design) of the program;
- help section where you can find answers to additional questions about using the program.
Attention! The "Vigilant Eye" program does not replace your main antivirus program, but it perfectly complements it, reliably protecting your computer from auto-runners and similar viruses.
And now let's go directly to the video tutorial, which was recorded by Sergei Medvedev, in which he will review the interface and tell you more about the functions and settings of the program.
Sharp Eye - protection against viruses on a USB flash drive
To learn more about the "Sharp Eye" program, as well as what other viruses it catches on removable media, visit the author's website.
P.S. How to protect yourself from absolutely any virus without a single antivirus program?
A USB flash drive is a very handy device, but often, it becomes a source of viruses. Modern viruses tend to infect a USB flash drive immediately after connecting to an infected computer. After the virus appears on the USB flash drive, it becomes dangerous for other computers. The degree of danger depends on the antivirus installed on the computer. Some users do not install anti-virus protection on computers and laptops at all, thereby putting their data and programs at risk.
1 way to remove viruses
To clean the USB flash drive from viruses, you can use a computer or laptop (netbook) with reliable antivirus. A reliable anti-virus is a paid version of an anti-virus program, for example, or Dr.Web Security Space. If a free version of antivirus is installed on your computer, for example, AVAST Free Antivirus, then it is better not to risk it - when you connect an infected flash drive, your computer may be infected.
In a specific case, we will remove viruses using Kaspersky Internet Security 2013 with the most recent databases.
We connect the USB flash drive to the computer. KIS will offer to check the connected removable disk. We select the Full scan option, which will thoroughly scan all files on the removable disk.
We choose the option "Full check"
In the first seconds of the scan, the antivirus detected a threat on the USB flash drive.
A threat was detected during the scan
After the scan was completed, Kaspersky Internet Security removed the virus itself.
According to the report, there was a Trojan program ("Trojan") Trojan.Win32.Inject on the flash drive.
As a result of the virus, folders and files (except for the file with the .exe extension) became shortcuts.
The virus hid files and folders, and instead created shortcuts with the same name. If you click on such a shortcut on an infected USB flash drive, a copy of the virus will start. In a specific case, Kaspersky removed the virus, so when you double-click on the shortcut, a message appears that the executable file could not be found.
The virus file has been deleted, so nothing criminal happens when you double-click on the shortcuts
How to return files on a USB flash drive to their original state?
You can remove the shortcuts that replaced files and folders on the USB flash drive - they are no longer needed. To restore the visibility of files, you can use the FAR Manager file manager. Read about how to do this in the article. With a high degree of probability, you can restore file displays using the curing utility, which will be described in the description of the second method.
Method 2: remove viruses and shortcuts + restore files
This method is suitable if:
- not only the flash drive is infected, but also the computer to which it is planned to be connected for virus treatment;
- the antivirus is not installed on the computer, or the antivirus is installed, but you doubt its reliability.
Dr. Web CureIt will remove viruses both from your computer and from a USB flash drive. Moreover, the utility will delete the shortcuts created by the virus on the USB flash drive and try to restore the display of files hidden by the Trojan. As an experiment, we will start checking only the flash drive (let me remind you that the virus has already been removed using Kaspersky Anti-Virus, but all files from the flash drive have "disappeared" and shortcuts have appeared instead).
We start a selective scan - select only the USB flash drive
The curing utility detected 8 threats BackDoor.IRC.NgrBot.42. Please note that the Trojan was listed as Trojan.Win32.Inject at Kaspersky Lab. This is not surprising, since different developers call their “wards” differently.
8 threats detected BackDoor.IRC.NgrBot.42
It should be noted that the utility clearly insured itself and included all the shortcuts leading to the previously deleted virus in the list of threats. It remains for us to click on the Disarm button.
After the found threats have been neutralized, you can open the USB flash drive and evaluate the result of the work. The Dr. Web CureIt worked 100%: threats were neutralized, and files were restored.
conclusions
The devil is not so terrible as he is painted. With some knowledge, in many cases, you can cope with viruses without losing your data. The main thing is not to fuss and not make sudden movements.
Do not forget that an antivirus program must be installed on your computer or laptop.
Read, how to remove a virus that converts files and folders into shortcuts... How to recover data that is lost as a result of the activity of such a virus. Have your files and folders on a USB stick or memory card become shortcuts? Is a USB flash drive or memory card displayed as a shortcut after connecting to a computer? Are you looking for a way to recover data and remove a virus that converts files and folders into shortcuts? Are you using an antivirus but your computer was infected anyway? Unfortunately, not all antiviruses can protect you from such infection.
Varieties of virus labels
Today, the most common are 2 types of viruses that create shortcuts: the first create shortcuts instead of files and folders on a USB flash drive or memory card, others create shortcuts for removable drives instead of flash drives themselves, external USB drives and memory cards.
The most common viruses are:
- Bundpil.Shortcu;
- Mal / Bundpil-LNK;
- Ramnit.CPL;
- Serviks.Shortcut;
- Troj / Agent-NXIMal / FakeAV-BW;
- Trojan.Generic.7206697 (B);
- Trojan.VBS.TTE (B);
- Trojan.VBS.TTE;
- VBS.Agent-35;
- VBS.Serviks;
- VBS / Autorun.EY worm;
- VBS / Autorun.worm.k virus;
- VBS / Canteix.AK;
- VBS / Worm.BH;
- W32.Exploit.CVE-2010_2568-1;
- W32.Trojan.Starter-2;
- W32 / Sality.AB.2;
- Win32 / Ramnit.A virus;
- Worm: VBS / Cantix.A;
A virus that converts files and folders into shortcuts
This virus duplicates your files and folders, then hides and replaces them. The virus is a combination of Trojan and worm viruses. The danger is that you launch a virus every time you want to open your file or folder. Once launched, the virus spreads itself by infecting more and more files and often installs additional malware that can steal data about passwords and credit cards stored on your computer.
A virus that converts flash drives and memory cards into shortcuts
It is a pure-blooded Trojan virus that hides any removable devices connected to the computer and replaces them with their labels. Each time you click on the shortcut, you launch the virus again, which looks for financial information on your computer and sends it to the scammers who created the virus.
What to do in case of infection
Unfortunately, not all antiviruses can detect danger in time and protect you from infection. Therefore, the best protection would be not to use the automatic launch of removable devices and not to click on the shortcuts of files, folders or drives. Be careful not to click on shortcuts that you did not create yourself. Instead of double-clicking to open the disc, click on it right mouse button and select Expand in Explorer.
Recovering data deleted by a virus
For reliable recovery of data deleted by this type of viruses use Hetman Partition Recovery. Since the program uses low-level disk functions, it will bypass virus blocking and read all your files.
Download and install the program, then analyze the infected USB flash drive or memory card. Carry out information recovery before cleaning the media from the virus. The most reliable treatment option would be to clear the flash drive using the DiskPart command, this will delete all information on it.
Removing a virus from a memory card or USB flash drive
After recovering data from a flash drive, you can completely clear it using the DiskPart utility. Removing all files and formatting the device can leave a virus that lurks in the boot sector, partition table or unallocated area of \u200b\u200bthe disk. How to properly clean a USB flash drive, see the video.
Removing a virus from a USB flash drive using the command line
This method does not allow you to guaranteedly clean the USB flash drive from all types of viruses, but it can remove the virus that creates shortcuts instead of files. You will not need to download and install third-party utilities; removal is performed using the tool built into any version of Windows.
Removing a virus from your computer
The easiest and most reliable way to clean your computer from a virus is to completely reinstall Windows and delete the system partition.
But if you are an experienced user, you can try the following method:
