The most common method people do to an infected flash disk to disinfect it is to reformat the drive. It may be due to the virus being undetectable. Or it may be because their anti-virus software is not updated.
But this is not necessary. It is never necessary for a removable storage. Viruses attach itself to a flash disk much less complicated than how you think.
The method that will be presented here will not use any of the reformatting technique. It will use simple commands that are available in Window's command prompt.
Here is the procedure:
1. Open up command prompt by pressing start then run. Then type "cmd" then ENTER.
2. Go to the drive letter of your flash disk. Type "f:" if it is in F, "g:" if it is in G, and so on.
3. Type "attrib" or "attrib >>log.txt" if there are a lot of files that it cannot be viewed entirely in the command prompt window.
4. If you chose the latter, type "log.txt."
5. Look for files that have the attribute "SHR."
6. If it is an autorun.inf file type "type autorun.inf." This will give a clue as to where and what the virus is.
7. Proceed to delete the file by going to the directory of the file using the "cd [directory]" command. Once you are there use the "attrib -s -h -r" command. Then use the "del [filename] " command.
8. Delete the autorun.inf file and other files with "SHR" attributes.
9. Find any other hidden files by using "attrib /s /d >> log.txt" command.
10. Type "log.txt"
11. Look for and delete all files and directories with an "SHR" attribute.
NOTE: There is a case where a virus will put an "SHR" attribute on all directories in the root folder of your flash disk. Then it will replace them with an executable file with the format [directory].exe - adds the .exe to the name of your directory. To cure this do the following:
1. Delete the autorun.inf file using the procedure mentioned above.
2. Remove all executables you know that is not a virus from the root directory. Copy it somewhere using the "copy [location] [destination]" command.
3. Then after you have done this and you are sure that there is no executable file of value in that directory type this command: "del *.exe"
4. Remove any unwanted folders created by the virus.
NOTE: If the files you have just deleted keep on coming back - like the undead, your computer is definitely infected. And the virus is currently running.
What you just did is pretty self explanatory. Here are the descriptions of the commands you just used:
"Attrib" - lists all the files in the directory and its attributes.
"Attrib /s /d >>log.txt" - lists in a file named "log.txt" all the files in the directory and subdirectory and its attributes.
"del" - deletes a file or directory.
"cd [directory]" - changes the directory to the specified directory.
"copy [location] [destination]" - copies a specified file to a specified location.
Type "help" in command prompt for more information.
No comments:
Post a Comment