How to remove Viruses from USB Drives

Madhur Kapoor has a good tutorial in his blog on how to prevent viruses in USB flash drives from infecting your notebook. Common viruses such as Ravmon, New Folder.exe, Orkut is banned, etc. spread rapidly through such drives and most anti virus programs are unable to detect them and even if they do, in most cases they are unable to delete the file, only quarantine it.

In Windows, one quick way of protection is to check for the files in the USB. A window similar to the shown below pops up whenever you plug in a USB drive:

Don’t click OK , click ‘Cancel’ instead. Open the Command Prompt by typing ‘cmd‘ in the run box. In the command prompt type the drive letter: and press enter . Now type dir /w/a and press enter.

This will display a list of the files in the USB drive. Look for the following files:

• Autorun.inf
• Ravmon.exe
• New Folder.exe
• svchost.exe
• Heap41a
• or any other exe file which may be suspicious.

If any of the above files are present, then the USB drive is likely infected. To delete these, go to the Start Menu -> Run. Enter cmd to run the command prompt.

In command prompt type attrib -r -a -s -h *.* and press enter. This will remove the Read Only, Archive, System and hidden file attributes from all the files in the USB drive. Now delete the files using the command del filename. example del Ravmon.exe. Delete all the files that are suspicious. Now remove the drive and plug it again. In most cases, the culprit will be the “Autorun.inf” file which runs whenever someone clicks OK in the dialog window above.

Alternately, you can also scan your USB drive with an anti-virus program but you need to make sure the anti-virus program has the latest database of viruses. Otherwise it might not be able to recognize the newer viruses.

Another method is to disable the Autoplay feature of USB drives. For this you will need Tweak UI. You can read the instructions on how to use it, as well as to download it, here.