Removable USB-devices for storing information in the form of the most common flash drives are exposed to viruses no less than hard drives with operating systems installed on them. And often to detect the presence of such a threat or to neutralize it can be quite problematic. How to remove the virus from a flash drive and restore files (hidden or infected) will be discussed later. To do this, you can use several basic methods. However, before applying them, it is necessary to find out what the user is dealing with. As they say, the enemy needs to know in person!
What viruses and how do they most often affect removable USB drives?
In general, there are not so many threats that are most often based on removable drives.
Most often, flash drives are affected by ransomware viruses and trojans that simply hide files and folders from the user. However, this category of threats is, in general, the most harmless, since information in the physical sense is not destroyed and does not go anywhere from the carrier. Thus, instead of the usual picture with all the files and folders recorded on the drive, it sees either only the shortcuts that came from somewhere or doesn't see anything at all.
Symptoms of having an infection
It’s quite simple to remove the virus, shortcuts, and related components from a flash drive that has settled there (we will dwell on this separately). But first, let's see how, in fact, to determine that a virus has entered the drive. Please note that shortcuts instead of files and directories may not always appear. Sometimes access to the drive may be blocked due to the fact that the operating system does not see it. But this is rare. In the case when viewing the contents of a flash drive is possible, first of all, in the usual Explorer, from the view menu, turn on the display of hidden objects.
If there is a virus on the storage medium, as a rule, there will be an invisible Autorun.inf file there, an executable EXE object, the name of which most often consists of a meaningless set of letters and symbols, and also a hidden RECYCLER folder (it may not always be present).
To be faithful, before connecting the device to a computer or laptop, in the autorun section located in the Control Panel, select “Do nothing” from the list for removable media, which will save you from an immediate threat coming to a stationary device.
How to remove the virus from a flash drive in the simplest way?
To begin, consider the simplest solution that immediately comes to mind for all users without exception. Suppose that there is no important data on a removable device, the user does not need files, and their copies or originals are on the hard disk or other media. How to remove a trojan virus from a flash drive? Elementary! To do this, you just need to perform full formatting, for which even regular Windows systems tools are suitable.
Portable scanners
But let's see how to remove a virus from a flash drive without losing data, if the information stored on the media is extremely important. It is clear that the formatting option is clearly not suitable. So what to do? You can, of course, try to delete several of the objects described above yourself, but it’s far from the fact that files and directories will be restored after infection (meaning that shortcuts are displayed instead). It is logical to assume that to neutralize the threat you need to use the appropriate antivirus software. And best of all, not standard protection tools (although you can use them) are suitable for this, but portable utilities, among which the most powerful are Dr. Web CureIt! and KVRT. Immediately pay attention to the settings of such programs. In them, the action to be taken when a virus is detected should not be set to delete infected objects, which may affect important user files, but, if possible, disinfection.
How to remove a virus that creates shortcuts from a flash drive manually?
Now a few words about what can be done if there is not a single suitable tool at hand. How to remove a virus from a flash drive in this case? It will require manual intervention. Some users find this a very difficult and tedious procedure. But actually it is not. First of all, through the PCM menu, check the properties of a folder, which is shown as a shortcut. Here, on the shortcut tab, pay attention to the “Object” field - there may be a long path in which the name of the previously mentioned RECYCLER directory (or some other) can be entered with the name of the EXE file. Try to delete the specified folder yourself. If this is not possible, use the Unlocker utility. After that, just in case, go to the AppData directory of the user directory on the hard drive, then check the Roaming folder, since the virus can migrate there, and after removing from removable media, again spontaneously copy to the USB flash drive.
Actions with file and folder attributes
But this is only half the battle. How to remove a virus completely and completely from a flash drive so that the information takes its previous form? Now, you will need to perform some actions with the attributes of hiding files and directories, which cannot be removed in the properties of any of these objects (the corresponding field with a checkmark selected on it will be inactive and marked in gray). In this case, you can use the most common Notepad to create an executable BAT-file and enter the contents shown in the image below as text.
The file itself should be saved by assigning it a manual extension and specifying in the “All files” type. After starting the saved file as administrator, all attributes will be cleared and the information restored.
You can do even easier by using the tools of the command console, which should be run as administrator. Two commands fit into it with pressing the enter key after each of them (we assume that the flash drive in the "Explorer" is indicated by the letter "F"):
- cd / df: \;
- attrib -s -h / d / s.
Note: punctuation marks at the end after entering the displayed commands are not needed!
Media recovery with third-party utilities
Finally, if you don’t like or don’t like the methods for removing attributes and restoring information described above, you can use special third-party utilities.
If we talk about how to remove the virus from a flash drive in this case, a small USB Hidden Recovery program is good, in which you must first set up a full scan and then perform a restore.
If the flash drive was still formatted, no matter what they say, you can use the R-Studio application, the use of which may not give the desired result unless in the case of low-level formatting.