Member Avatar for ezkonekgal

i have this virus in my flash disk, how do i remove this? please help?

  • 2 Contributors
  • 2 Replies
  • 291 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by jholland1964

Dani AI

Generated

Short expert summary and safe first steps. reported a script on a USB stick that looks present but resists deletion; that symptom often comes from either filesystem corruption or malware that hides or locks items so normal tools report "not found." 's suggestion to run a removable‑drive cleaning tool is reasonable; if that did not clear the stubborn entry, follow the triage below before trying more destructive fixes. (superuser.com)

Triage (do this first): stop using the infected PC for anything sensitive, do not open the file, and isolate the USB. On a known‑clean machine download a current on‑demand scanner and run it against the drive (save the scanner to removable media if the infected PC blocks web downloads and run it there). This approach avoids letting the live infection interfere with cleanup and is explicitly recommended by Microsoft for cases where downloads are blocked. Back up only what you need and scan those copies before opening. (support.microsoft.com)

Quick diagnostic commands (PowerShell) — run these as Administrator on a clean system or in a rescue environment; change the drive/root paths as appropriate and inspect results before deleting anything:

# list likely script/shortcut/exe files on all local volumes
Get-PSDrive -PSProvider FileSystem |
  ForEach-Object {
    Get-ChildItem -Path ($_.Root) -Recurse -Force -ErrorAction SilentlyContinue |
      Where-Object { $_.Extension -match '\.(vbs|lnk|exe|bat)$' } |
      Select-Object FullName, Attributes, Length
  }

# example: clear Hidden/System attributes on a single drive (use with care)
Get-ChildItem -Path 'E:\' -Recurse -Force -File -ErrorAction SilentlyContinue |
  ForEach-Object { $_.Attributes = $_.Attributes -band (-bnot [System.IO.FileAttributes]::Hidden) -band (-bnot [System.IO.FileAttributes]::System) }

If removal is difficult because the malware is active, run vendor rescue/boot scans or perform the scan in Safe Mode first; some vendors document safe‑mode/boot scanning workflows for stubborn infections. After a clean scan, copy recovered data to a known‑clean location and fully reformat the USB before reuse. (support.eset.com)

Prevention: disable automatic execution of code from removable media and consider blocking script hosts if scripts are not needed in that environment — both are recommended hardening steps but can affect legitimate tools, so test before applying widely. If unsure or the infection persists, consult a respected removal forum or a professional to avoid data loss. (cisa.gov)

Recommended Answers

All 2 Replies

Member Avatar for ezkonekgal

Go to Start > Run and type: cmd

* press Ok.
* At the command prompt, type in your primay drive location, usually C:
* You may need to change the directory. If so type: cd \
* Hit Enter.
* Type: attrib -s -h -r -a autorun.inf
* Hit Enter.
* Type: dir
* Hit Enter. This will allow you to see and confirm the Autorun files.
* Type: del autorun.inf
* Hit Enter.
* Repeat the above commands for each drive on your computer including your flash/usb drive.

Now search for and remove sowar.vbs, SysRes.vbs, Cool USEP Scandal.vbs

* At the command prompt, type in your primay drive location, usually C:
* Hit Enter.
* Type: attrib sowar.vbs.* -s -h -r -a
* Hit Enter.
* Type: dir /s sowar.vbs
* Hit Enter.
* If the file is present, type: del sowar.vbs
* Hit Enter.
* Repeat the above commands for each drive on your computer including your flash/usb drive.
* Then repeat these instructions to search for and delete SysRes.vbs, Cool USEP Scandal.vbs on each drive if present.
* Exit the command prompt and reboot normally.

I FOUND THIS ON THE NET.. BUT IT DOESNT HELP. ON MY COMMAND PROMPT IT SAYS FILE NOT FOUND EVEN THOUGH IT IS STILL THERE.. any suggestions?

Member Avatar for jholland1964

You have two threads going on this problem, you should keep it all in one to avoid confusion.
That said, you might try this recommendation found HERE

Download by sUBs and save it to your desktop.

* Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
* The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
* Wait until it has finished scanning and then exit the program.
* Reboot your computer when done.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you run it. Don't delete this folder...it will help protect your drives from future infection.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.