Search This Blog

Tuesday, April 28, 2009

Removing virus from usb drive

Common viruses such as ’Ravmon’ , ‘New Folder.exe’, ‘Orkut is banned’ etc are spreading through USB drives. Most anti virus programs are unable to detect them and even if they do, in most cases they are unable to delete the file, only quarantine it. Here are the things which you can do if you want to remove such viruses from your USB Drive


Whenever you plug a USB drive in your system, autorun window will display.

Don’t click on Ok , just choose ‘Cancel’. Open the Command Prompt by typing ‘cmd‘ in the run box. In the command prompt type the drive letter: and press enter . Now type dir /w/a and press enter.

This will display a list of the files in the pen drive. Check whether the following files are there or not

•Autorun.inf
•Ravmon.exe
•New Folder.exe
•svchost.exe
•Heap41a
•or any other exe file which may be suspicious.

If any of the above files are there, then probably the USB drive is infected. In command prompt type attrib -r -a -s -h *.* and press enter. This will remove the Read Only, Archive, System and hidden file attribute from all the files. Now just delete the files using the command del filename. example del Ravmon.exe. Delete all the files that are suspicious. To be on a safer side, just scan the USB drive with an anti virus program to check whether it is free of virus or not. Now remove the drive and plug it again. In most of the cases, the real culprit turns out to be the “Autorun.inf” file which mostly gets executed when someone clicks Ok in the dialog window which appears above. Thus the infections can spread.

No comments:

DISCLAIMER:

All photos, wallpapers and other content materials posted at CLASSICTIPS.BLOGSPOT.COM were found via internet search engines and other websites, the legal copyrights of those content belong to the actual owners. We have taken our effort to acknowledge the copyright owners where possible, but there might some missing out.

If you feel any of your copyrighted material is seen in this blog you may comment on the posts and those will be removed. Thank you.