Articles

How To Remove Virus From USB Without Losing Data

USB drives are prone to virus attacks, as they are frequently transferred from one device to another. Virus attacks can put your data at risk. If your USB is infected, you won’t be able to access all your files on the drive, or worse, they will be corrupted and may even be permanently deleted.  

That’s why if you often use a USB to store your data, you must know how to get rid of viruses and protect your files using enhanced cybersecurity protocols or security specific laptops. In this article, I will show you how to remove virus from USB without losing data.  

A shortcut virus is a combination of Trojan and worm viruses that gathers and hides all your files and folders, replacing them with shortcuts that look like the original files but are inaccessible.  

Launching these false shortcuts will run the malware, which will duplicate the virus and further infect your USB and your OS. This can lead to all kinds of malware-related side effects, including worsened system performance and stolen personal data.  

Related: APT Vs Malware Differences Explained

Unfortunately, many users can’t identify if their USB is infected with viruses. So here are some warning signs that your USB might have viruses:  

Related: Phishing Vs Spear Phishing Attacks Explained

  • Unknown Shortcut Files 
    If you see that your original files are converted into shortcut files, unknown shortcut files are on your USB, or the drive itself is in the form of a shortcut, your USB is attacked by a virus. 
  • Strange Options In Drive's Right-Click Menu 
    New and unrelated options in your drive’s right-clicking menu often mean it’s infected. 
  • Unable To Open The Drive 
    An inaccessible drive usually means that your USB has a virus in it. 
  • Disk Icon Becomes Folder Icon Or It's Deleted 
    If the USB's disk icon changes to a folder icon or disappears entirely, it’s highly likely to be infected. 
computer circuit board

How To Check A USB For Viruses? 

Since USB drives are susceptible to viruses, it is best to check for viruses before using them. However, in most systems, the AutoRun function automatically opens the USB drive, which restricts you from checking the drive and spreads the virus if infected.

Fortunately, there’s a way to disable this feature, ensuring that your USB is free from any viruses before using it. Here’s how: 

  1. 1
    To disable the AutoPlay function in Windows 10, click Start Settings AutoPlay. Under the "Use Autoplay for all Media and Devices” option, toggle the button off.  Alternatively, you can click the search button and type “AutoPlay.” This will bring you to the AutoPlay settings.  
  2. 2
    After disabling AutoPlay, insert the USB. Next, click Start or the search icon and type in “CMD,” then press Enter. This will launch the command prompt. 
  3. 3
    Check the drive letter of your USB drive, type it in the command prompt, and press Enter. This will change the C:\Users\ line to the drive letter.  
  4. 4
    Once you’re commanding the drive folder, type in "dir /w/a” and press Enter. This command will give you a directory list of all the files on your USB. Carefully inspect the list and check if any of these files are present:  
  • Autorun.inf 
  • New Folder.exe 
  • Ravmon.exe 
  • Svchost.exe 
  • Heap41a 

If they are, your drive is most likely infected, and the viruses should be removed from it immediately.  

black usb drive in laptop

4 Ways To Remove Virus From USB Without Losing Data

If you want to know how to remove a virus from a USB without losing data, there are different methods you can try. Below are some ways you can do to remove an infection from your USB without losing your precious files:  

Remove Virus Using CMD

To remove the shortcut virus from your USB and recover your files, you can use the Command Prompt in your system. This is one of the best methods and has a 95% chance of removing the infection. Below are the steps on how to remove a shortcut virus from USB without losing data through CMD: 


  1. Click the Start or the search icon and type in “cmd.” Right-click the Command Prompt and click Run as administrator.  

 

  1. Insert the infected USB and take note of the letter of the drive. On the Command Prompt, type the following command  attrib -h -r -s /s /d F:*.* 

Note: The in this command is the drive letter. Make sure to change it to the correct drive letter that is affected by the virus.  

 

Command explained: 

  • Attrib - an MS-DOS command that helps alter the properties of the file folder. 
  • -h - shows all the hidden folder 
  • -r  - recreates the files on your drive 
  • -s - removes the link of files in the system. 
  • /s - directs the command to loop at all the files and folders in the entire device 
  • /d - directs the command to apply to folders as well since the attrib command only handles files. 
  • *.* - indicates that all file names and folder names should be considered a match. 

3. Press Enter and wait until the command is completed.  Once done, the command will recheck your drive and convert the shortcut files back to normal files.

After the command process is completed, go through your drive, and delete any unknown files you can find. Then, transfer all the recovered files somewhere, and reformat your USB drive before using it again.  

Remove Virus By Generating Batch File 

A batch (BAT) file is a script file that can help remove viruses from your USB. No need to download anything, all you need is your system’s Notepad. Here’s how you can generate a BAT file:  

1. Open the Notepad found in your system and copy and paste the following code:  

2. @echo off 

attrib -h -s -r -a /s /d H:*.* 

attrib -h -s -r -a /s /d H:*.* 

attrib -h -s -r -a /s /d H:*.* 

@echo complete 

Note: Don’t forget to replace the H: with your drive letter.  

 

4. Save the file using the correct name so you won’t be confused, and add “.bat” at the end of the filename. (Ex.:removevirus.bat) 



5. Close the Notepad and run the BAT file with admin privileges (Right-click the file and select Run as administrator). This will clear all the existing shortcut viruses.  

Remove Virus By Tweaking Registry Files 

Tweaking your registry files can prevent shortcut viruses from infecting your system. However, it can harm your computer, so use this method at your own risk.  

  1. Press Ctrl + Alt + Del simultaneously to launch the Task Manager and click Processes. On this tab, look for wscript.exe, click on it and then click End Task. 

  1. Open Run by pressing Windows + R key together and then type Regedit. Hit Enter. This will open the Registry Editor.  

 


3. On the Registry Editor, double-click  HKEY_CURRENT_USER > Software > Microsoft > Windows > CurrentVersion > Run. On this page, look for odwcamszas, right-click on it and press Delete.  

Remove Virus By Using Anti-Virus Programs 

If you are overwhelmed by all of the commands above or don’t have enough time to do these methods, you can remove the virus from pen drive online and free (sometimes!) through reliable anti-virus programs. 

There are tons of free and paid anti-virus programs, which can automatically eliminate any existing virus in your USB drive. 

Related: What's The Difference Between A Firewall & Antivirus Software?

People Also Ask (FAQs)

How does my USB get a virus? 

A pen drive or USB can get a virus from an infected computer. So be sure to insert your USBs on trusted computers.  

How do I avoid getting a shortcut virus on my USB?  

If you can, never use your USB on a public computer. Disable AutoRun in your system and always scan your device for any virus.  

How do I remove a virus from my USB online for free? 

There are tons of free anti-virus software available online. Make sure to choose a reliable one.  

Can I remove viruses by deleting files on my USB? 

Deleting the infected file from your USB will delete both the virus and the file. However, if the virus has already infected other files, you need to delete all of them, which can compromise your data.  


Conclusion

Even if you are the most careful person, your USB can still be infected by viruses. The methods mentioned above can help remove infections from your USB and preserve your precious data.

However, the best way to keep your data safe is to prevent your USB from being infected by viruses. Therefore, always be vigilant and careful where you insert your pen drive to ensure its safety.