General Malware Removal Guide From USB Drive

USB Drive (aka Pendrive) is the most common storage device. However most of the people always had their USB Drive infected with all sorts of virus, malware, trojan, spyware or whatever you call it. For a normal user, they might not know if their USB Drive is infected or not. Want to know how to check and remove all the malware from your storage device? Read the guide below.

1. Whenever we plug in our USB Drive, Windows XP will prompt us with a window as shown above. Most of the time, most of the people will scroll down and click "Open folder to view files". If the USB Drive is infected with malware, clicking "Open folder to view files" will execute the malware in the USB Drive and it will spread and infect the Windows in the background. So, first thing when we see this window, we must click Cancel .

2. To open your USB Drive, Click on My Computer. Do not double click on the USB Drive because it works the same with "Open folder to view files" in first step, it will execute the malware if the USB Drive is infected. In order to access the USB Drive, refer to the screenshot above. Click on the drop box at the address bar, then select the USB Drive, in my case it is KINGSTON (I:).

3. My USB Drive is clean and free of malware, therefore I can't show you screenshot of my USB Drive, instead I asked my friend to send me a screenshot of his USB Drive as example to eleminate the malware. Refer to the picture above, that is what you see normally after you access your USB Drive. However there could be some malware hiding in your USB Drive which you don't know.

4. Next, Click Tools then click Folder Options . Click on the View Tab. Under Advance Settings scroll down and click Show hidden files and folder - ON , untick Hide protected operating system files (Recommended) - ON then it will prompt something and click YES . Refer to the screenshot above if you don't know what I mean. After that click Apply. Follow the Steps Below if you having problem with Step 4. Else you can skip it and go to Step 5. If Folder Options is disabled but Registry Editor is still working in your system, then you can enable Folder Options by editing Windows Registry. Click Start then click RUN. Type regedit in RUN dialog box and press Enter. it’ll open Registry Editor, now go to following keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Explorer HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Policies\Explorer

In right-side pane, check whether a DWORD value named NoFolderOptions exists or not? If it exists, delete it. But sometimes Registry Editor is also disabled. Click Start then click RUN. Type following in RUN dialog box and press :

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

Now after enabling Registry Editor, you can re-enable Folder Options . There have been cases of viruses like Kavo changing back the hidden files back to hidden after you enable it. To fix this, Go to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

find for CheckedValue, it should be a DWORD key. If it is not then delete it.

5. After finishing Step 4, if your USB Drive is infected with malware, you should be able to see some weird file like shown in the first sceenshot above such as Autorun.inf. Right click at Autorun.inf then click open with Notepad . You should be able to see what is in the second screenshot. It targets the malware whi.com and now you can close the Autorun.inf. Next you can delete all the files associated with the Autorun.inf and suspected malware files . Then Empty your recycle bin. If your Windows has been infected with malware already, the malware will be automatically infect your USB Drive when you plug in your USB Drive. So following the steps above will be useless. It is only useful for you to prevent your Windows from malware.