Autorun trojans/viruses from the thumb drive can easily be transfered from PC-to-PC. The outcome? Users found that their drives had been inaccessible through double-clicking the drive icon. But was accessible through the right-click explore menu. Should you encounter this situation again, here’s the solution:
1. Download flash_disinfector.exe by sUBs.
2. Run the program and follow the on-screen instructions.
3. Done ! Thanks to sUBs.
Alternate method:
1. Right click the infected drive.
2. Click on Explore.
3. On the top window menu, choose Tools > Folder Option.
4. Under the View tab, check “Show hidden files and folder”.
5. Uncheck “Hide extension for known file types” and “Hide protected operating system files”.
6. Browse through the infected drives for unknown files(files starting with autorun,infrom,vbs) and delete it.
7. Remove your thumbdrive and insert again. Undo what you had perform on Folder Option.
Extra protection:
- Panda USB Vaccine - prevent future infection
I tried the alternate method but after i removed and insert my thumbdrive the autorun and ghost file is still there.I even tried to format my thumbdrive yet its still there.Any advise?Seems method 1 link is down?Pls help thanks
Hi troubled,
Thanks for letting us know about the broken link.
I’ve uploaded the tool to our server instead.
Try downloading again. =)
Best regards,
Dr. Safemode
Few days back I used flash_disinfector.exe for repairing /solving problem with my pendrive .
pen drive was fixed but the appliction created a foder on D drive (local drive) containing a file named lpt3 neither that file nor the folder can delated .Why that folder is created by flash-disinfector & y it can’t be deleted? THIS IS MY NEW PROBLM.
Hi gten,
Flash_disinfector is supposed to create a folder name “autorun.inf” with file name “Who created this folder.txt” that resides in that folder. The purpose is to protect from similar infection in the future.
If you need to delete the folder, you can boot Windows into Safemode by repeatedly pressing the F8 button on restarting Windows, this will bring up a menu. Choose to boot Windows into Safemode.
While Windows is in Safemode, you should be able to delete it.
Hope this works for you. =)
Dr. Safemode
First reboot your PC and go to safe mode by pressing F5 or F8
Go to dos prompt or command prompt (using CMD)
Attrib -h -s -r autorun.inf
del autorun.inf
Attrib -h -s -r autorun.exe
del autorun.exe
And then verify that they are gone by using dir /ah command.
See below for more example:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\TOON>Attrib -h -s -r autorun.inf
File not found - autorun.inf
C:\Documents and Settings\TOON>del autorun.inf
Could Not Find C:\Documents and Settings\MIS\autorun.inf
C:\Documents and Settings\TOON>cd\
C:\>Attrib -h -s -r autorun.inf
C:\>del autorun.inf
C:\autorun.inf\*, Are you sure (Y/N)? y
D:\>del autorun.inf
D:\autorun.inf\*, Are you sure (Y/N)? y
By now you should be able to see that irritating created by Flash_disinfector file is remove.
Gurantee…
Hurray HAHAHAHAH!!!!
Thanks den for your contribution!
my problem is.. my pendrive shows empty… but i really have many important things in it… how to solve it? Is it because of virus??
Hi Gab,
Can you check how much space is already taken on the pendrive? (right click then Properties of the drive)
I have not experience a virus which hides stuffs. Hence otherwise, when you open the pendrive, on the top menu, Tools > Folder options > View > Advanced Setting > Show hidden files and folders.
Hey !
If you double click ‘flash_disinfector.exe’
the antivirus detects the following threat :-
“W32.sillyFDC” !
PLz help ! Now the possible solution comes with yet another trouble.
How do I keep Superman from molesting my sister !
Hi Jhonny,
Perhaps you might want to try F-Secure online scanner to remove the virus from both on your thumbdrive and computer. It is very good. http://support.f-secure.com/enu/home/ols.shtml
I guess you’re using Norton? Yes, people have reported that Norton blocks flash_disinfector from working properly.
Hi Dr Safe,
I’ve used the first method on my thumbdrive and the trendmicro warnings no longer pops up. May I know if my thumbdrive is now rid of virus and can be used normally? Or does the sUBs program only blocks the virus from autorunning. Thanks alot!
Cheers,
Matt
Hi Matt,
The sUbs program does delete the virus from the disk.
If you want to be sure, perform the second method and check whether there is any unknown files/folders to you on the disk(root directory).
I would also recommend to initiate an online scan at
http://support.f-secure.com/enu/home/ols.shtml
Dr. Safemode
Hi,
Thank you so much for this!!! Finally able to use my thumb drive!!! This stuff really works!!!
Hi..i mann.. i think today is the best day for me due i able to settle my thumbdrive problem..after use your software ..all the problem retrive.. tq
Hi, I have something really important on my thumbdrive. Before I would just open my file and it would be no problem and now when i click on it, it says I need to format the disk. When I press on the ok to format it says your not authorized. I even went to properties and it says 0 bytes used. what can I do to fix this problem?
@Robert,
Could you right click and click on Explore? Then perhaps delete any suspicious files.
Do use an online scanner to scan your computer.
http://support.f-secure.com/enu/home/ols.shtml
Hi, I recently used my thumb drive on a friends computer and now whenever i put that thumbdrive in my computer all of the windows that i have open start to jump around and the tabs at the bottom of the screen appear to be at the top (but there still really where they should be). This virus or whatever it is seems to spread aswell as another friend used their flash drive on my computer and the same thing happened to him. Numerous Norton’s antivirus scans have been unable to stop this from happening each time. Any suggestions?
Hi Tom,
Since Norton is unable to prevent it from happening, why not install a trial version of Kaspersky Anti-virus 2010?
Here’s the link
http://www.kaspersky.com/trials
Download it, then 1st uninstall Norton. Install Kaspersky.
Plugin your thumb drive and perform a full scan on all the drives, including all your hard drives.
http://www.drsafemode.com/2009/08/20/kaspersky-anti-virus-2010-review/
Get back to me if Kaspersky still doesn’t do the job. ^ ^
Regards,
Dr. Safemode
I downloaded the flash disinfector and tried to use it. It would not install properly, and my system said it was infected. I tried the second method, and deleted one mysterious folder, but my computer is still showing signs of the virus. I did eventually get the flash disinfector to do something, but I don’t think it took the virus off of my thumbdrive or my computer. Now what am I supposed to do?
Well, last night I did a “System Restore” on my computer. This managed to get the virus off of my hard drive. I was able to get the Flash Disinfector to get the virus off of my thumbdrive, as well. System Restore is the cheapest way to kill a virus, and most computers have it.
I encountered a virus which was almost unstoppable - even NOD32 couldn’t prevent it from auto-running. Only my school’s anti-virus (sorry but I forgot the name for it) could restrict the virus’ access and effectively exterminate that shit. The virus I met would stay in my hard drive and it would lag the hell out of my computer. I tried system restore and it works, maybe some of you guys here might want to try it too…
Tech Question:
Q
Hi
After installing it, the virus seems to have been removed. However I face another problem.
Whenever i try to open my portable hard drive, it says [choose program you want to use for the file]
What’s happening
hey dont worry abt it, solved!
Hello, like this blog alot. I found it on yahoo will add it to bookmark and come back often again to read and follow. Please continue to do great job you do on it.
please help me!! my pendrive attack by a virus…file in my pendrive cannot delete or cut,if format it will display “The disk is write protected”. i have delete the autorun.inf but still same…in my pendrive have one hidden protected operating system file “$RECYCLE.BIN”..
Yea, uh my Symantec is flaggin this as w32.sillyFDC…..so your telling me you offer a download that has a virus in it already!? awesome. Not the fix i was lookin for but hey….
Um, hi. I used your alternate mode but I want to make sure: If you uncheck “Hide extension for known file types” and “Hide protected operating system files”, would that make virus go into the computer?
Also, I scan the thumbdrive and it says that there is an infected file but the scanning program wouldn’t clean it. Can you tell me what this means?
Thanks.
btw i use ESET Smart Security, any help to you?
Sorry I gave you the wrong website name
No, it doesnt make a virus go into your computer. Your second question means that your antivirus was not able to delete or remove the virus.
Please try scanning online with F-secure:
http://support.f-secure.com/enu/home/ols.shtml
Dr. Safemode,
Eset Nod 32 found “autorun.inf” on my usb drive and deleted it. When I looked at the USB, I see some folders having exe extention after folder names. I am sure that my USB drive was clean before I plugged in to my computer because I checked it on other computers having the same Eset nod 32 system.
Also Eset Nod 32 could not found a virus on my computer eventhough it could found “autorun.inf” on usb which was surely clean.
How can I fix the problem?
thanks….
Hi inevitable,
Try deleting the other folders having an .exe extension.
These folders may be the culprit of remaking the autorun.inf.
omg previously it showed all my folders in the drive were 1kb but i could check the actual size i’d used in it, i just couldn’t get back the things! but the alternate method has helped me!!! thank you very much! I’m tremendously grateful1!!!
Now I decide to write some lighter stuff, less work and also try to test the market & see what people like to read
This is the first time here. Great site. I have a pile of infected drives from one computer we were using to run power point. Virus gone on computer. Now I can use these methods to clean thumb drives. I’m running Norton Anti-virus Corporate Edition 10.0. I’ll be back if I have problems clearing my w32.silly scourge.
Online net directory. Annex your site to our directory for free. Do not get rid of the entries. do gazu!
We believe I simply have been told relating to this issue from work 2 days ago with a friend, however in those days this didn’t caugh my attention.
Dr. Safemode,
I found out there’s a virus on my flash drive and I tried to open the folder and I found a jpg. image and I, being a fool, deleted it.
Every time I try to open the folder on my flash drive this message comes up: “Windows cannot find J:\RECYCLER\DSC15829.jpg” Make sure you typed the name correctly, and then try again.”
Can you help me? Thanks.
When I try to use the flash disenfecter I get cmd.exe - no disk.
I know the SD drive is working because I can read the files on it . Any ideas? - Thanks.
My computer was recently infected by a virus. I had Norten Live remove it. But, now I am having issues with my usb and cd drives. My usb files were all converted to “archived”, so I couldn’t use them. I changed these back, and looked at hidden files to find something called “trashes”. I deleted this as well. All seemed well. But I plugged in a brand new usb–it worked great for about a week, and then suddenly all is archived. When I “unarchived” the files, they are still unusable. Message: “Saving xxx Failed. Could not open xxx for writing: permission denied”. Also, when I plugged in a brand new, empty usb, and hit the “safely remove usb” thing, I get a message saying that it can’t be removed because a program is using it….??? I can’t do anything!! Help!!
very worthwhile video
I really love to read this post and I am glad to find your distinguished way of writing the post. Thanks and Regards
Spot on with this write-up, I truly think this website needs much more consideration. I’ll probably be again to read much more, thanks for that info.
Thanks for all the information you give on this website. It’s a shame how the folks who publish these malware don’t put their effort towards more beneficial things. Perhaps they are generating tons of money and that is all they care about. Fortunately one can find people like you to aid others stay protected.