November 12th, 2008 by admin

If you suspect your USB drive is infected by virus, just follow these few steps to remove it.

1. WARNING! Do not double click on your USB drive icon on My Computer, it will execute the virus.
2. Locate AUTORUN.inf file by keying in E:\autorun.inf (Assume E: is your USB drive) on your address bar.
3. Once the autorun.inf is run, find out what files the virus executes (usually in .exe extension) when your USB drive is double clicked.
4. Delete all the files are listed on AUTORUN.inf which are used by the virus.
5. Remove the lines in AUTORUN.inf which execute the virus or you may just delete the AUTORUN.inf file.

If you cannot view the hidden files in your USB drive, follow these few steps:

1. go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden.
2. Set the value back to 0 (means NO).
3. If you cannot view the Folder Options, go here -> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
4. Under NoShowFolderOptions, change it to 0.

In some cases, viruses like Kavo will change the files back to hidden, follow these steps to prevent it:

1. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
   Advanced\Folder\Hidden\SHOWALL
2. Find CheckedValue, it should be a DWORD key. If it is not, delete it.
3. The Folder Option should be working now.
4. Delete everything associated with AUTOFUN.inf.
5. Done!

Thanks to ericmaxman for sharing this.