As more and more computer users carry USB sticks with them to store and transfer their data, it was only a matter of time before virus writers targeted these devices as a delivery mechanism. This is done through the use of an autorun.ini file. This type of file is basically just a text file with instructions to execute other files. The other files are the actual virus payload. They may have names like Ravmon.exe, New Folder.exe, svchost.exe, and possibly another files with a.dll extension.
Manual USB virus removal can be very tricky and it is suggested that you use a good antivirus / spyware removal tool to prevent and remove risks automatically. The first thing to do is make sure you have a good backup of your files on the USB stick. Offsite backups allow for greater peace-of-mind. Next, you'll want to make sure your computer is not set to automatically run CDs and removable devices. Microsoft has a one-click solution located in their knowledge base (967715) to disable autorun.
It's best to attempt removal of infected files through the operating system's command prompt. Simply click Start, Run (or Search programs and files) and type cmd, Enter. Enter the drive letter your USB stick is using. If you need to check, go to My Computer (or Computer) and see what drive letter has been assigned to the USB device. Next, in the command prompt type that drive's letter, eg, if it's E, type e: to switch to the E-drive).
Then, make sure all files, including hidden and system files, are showing. So, type attrib -rsh. This will ensure the files are not read-only and that system and hidden files are showing. Delete the autorun.ini file and any.exe and / or.dll files that look like they do not belong. The key thing is to make sure the autorun.ini file is gone. This will keep the virus from replicating again.
It's potentially impossible to keep your USB memory device free of viruses when it gets used in other computers; however, as long as you have autorun disabled on all of your computers and use up-to-date virus protection software, you will less the chances of becoming infected.
0 comments