Ridding Virus From Usb Without Deleting Files

[Latindancer]

I have a virus on my USB thumb drive, which is diasppointing because I really value the files there. Googling information has not produced anything of value. Panda have a "USB vaccination" but it only stops the USB from infecting computers in the future (and perhaps getting infected itself.....in the future).

I ran a drive cleaner (can't remember name ) but it didn't fix the problem. And there is info on the web about how to manually delete the virus, but in doing so, it seems to delete files as well. Or am I mistaken in this ? It is as follows :

1. Go to Start—-Run. Type cmd and hit enter. This will bring up the command prompt.
2. Type the drive name of the USB drive and hit enter.
3. In command prompt type attrib -r -a -s -h *.* and press enter. This will remove the Read Only, Archive, System and hidden file attribute from all the files.
4. Now just delete the files using the command del filename

Could anyone suggest a way to get my files viewable again please ? I have vaccinated the USB using Panda, so it should be OK from now on.....

[H2oDunc]

How you get rid of the virus will depend on what virus you have been infected with. If you know the name of the virus then Google it and you will find a way top delete it without losing your files. Have you no anti virus or anti malware ?

[somchai69]

There should be an option in your standard PC antivirus programme to

scan and clean the USB stick, without deleting the files.

Have you tried that?

[BB1950]

You have me a bit confused.

The steps:

Go to Start—-Run. Type cmd and hit enter. This will bring up the command prompt.

Type the drive name of the USB drive and hit enter.

In command prompt type attrib -r -a -s -h *.* and press enter. This will remove the Read Only, Archive, System and hidden file attribute from all the files.

Should have made the files 'viewable' unless in the process of vaccinating them or quarantining them place them in a hidden archive file.

[H2oDunc]

If you are not a confident computer user, and if you were you would not be asking HOW TO on TV, I would seriously advise you not to mess about with the command prompt. It is only ever going to end in tears.

If you have anti virus then right click on the USB drive and select either scan or clean depending on your anti virus.

[H2oDunc]

If you are not a confident computer user, and if you were you would not be asking HOW TO on TV, I would seriously advise you not to mess about with the command prompt. It is only ever going to end in tears.

If you have anti virus then right click on the USB drive and select either scan or clean depending on your anti virus.

[Latindancer]

I am in fact very wary of messing around with Command Prompt to delete anything......I need these files on my USB stick.

I only just arrived back in Thailand and don't have a computer yet....I'm using internet cafes. So I'm limited to their computers' antivirus programs......to a certain extent.

I could download any kind of antivirus program temporarily, then use it on my USB thumb drive....

Any recommendations for one specifically to rid USBs of a virus ? Or just Google it ?

[phuket Mike]

These USB viruses are everywhere in Thailand, they usually run by a hidden autorun.inf, generally they seem to be harmless. I first step is to disable autorun this at least stops them from spreading. The second option would be to load something like autorun eater, which is a memory resident program that detect these files and stops them from running (these viruses are particularly prevalent on memory cards from mobile phones). I recently loaned my digital camera to someone and it's SD card came back with a virus.

By far the best solution I have found is to purchase a good AV program I am currently running AVG 2011 and it immediately finds these viruses and removes. As I have a number of USB drives and memory cards I found they all had viruses mainly coming from from internet shops, but AVG found them all.

Trying to delete these files from the command prompt is a pain and I am a very experienced DOS user, in today's world you need a good professional AV product it's worth every penny.

[Latindancer]

Alrighty.....

I just tried with NOD32 (installed on this cafe's computer) , but no luck.

I'll download AVG Free and give it a go.........Thanks for your help, folks.

[phuket Mike]

One final tip when you get rid of it. Create a directory called autorun.inf on your USB stick, this will stop future viruses installing themselves because they will not be able to create a autorun.inf file because there already a directory of the same name.

[AyG]

One final tip when you get rid of it. Create a directory called autorun.inf on your USB stick, this will stop future viruses installing themselves because they will not be able to create a autorun.inf file because there already a directory of the same name.

And viri aren't smart enough to detect the presence of an existing autorun.inf and delete it before installing their own version? Do we really live in a world populated by fluffy clouds, cute baa-lambs, ponies and unicorns?

[Latindancer]

Two important pieces of information :

There is already a file named Autorun.inf on my memory stick. Perhaps the Panda Vaccination program put it there ?

Hmmmm....I just deleted it....still can't open anything. Dang

Secondly, when trying to open files, I get an error message saying "the item "voaheax.exe" that this shortcut refers to has been changed or moved, so that this shortcut will no longer work properly".

_ALL _ my files say this when I try to open them, so I Googled "voaheax.exe" and got ONE result only !!!!! .........It's for an antivirus program called Prevx 3.0 which claims to remove this virus. Free scan, but you have to pay for the program if you want to clean your USB stick.....or computer.

Only one Google result for voaheax.exe seems odd. But there it is, on my USB, preventing me opening anything.

Edited April 27, 2011 by Latindancer

[BB1950]

Two important pieces of information :

There is already a file named Autorun.inf on my memory stick. Perhaps the Panda Vaccination program put it there ?

Hmmmm....I just deleted it....still can't open anything. Dang

Secondly, when trying to open files, I get an error message saying "the item "voaheax.exe" that this shortcut refers to has been changed or moved, so that this shortcut will no longer work properly".

_ALL _ my files say this when I try to open them, so I Googled "voaheax.exe" and got ONE result only !!!!! .........It's for an antivirus program called Prevx 3.0 which claims to remove this virus. Free scan, but you have to pay for the program if you want to clean your USB stick.....or computer.

Only one Google result for voaheax.exe seems odd. But there it is, on my USB, preventing me opening anything.

Sounds like you are way over your head!

1. The Panda Vaccination program would not have put an autorun.inf file on your USB stick.
2. Are you sure you actually used a Panda Vaccination program? Malware usually trick you into doing a scan with their program, with is often disguised as legitimate antivirus programs. Then they will often make you fall for a scam to pay for a program to remove the malware that was installed by doing a scan, which doesn't.remove the infection.
3. Having more than one antivirus program installed on a PC actually defeats the detection of malware.
4. Your valuable files are not shortcuts. So the machine you are using is most likely infected.
5. Without having a clean machine with a good up to date antivirus program installed will make it almost impossible for you as a novice to disinfect. I would not trust any machine in an internet cafe. They commonly are infected.
6. My advice for you is to take the USB stick to a reliable computer shop or to someone qualified to remove the infection and have them remove the infection. It should only cost 300 baht at the most. You don't have the tools or experience.
7. Otherwise you risk permanently losing your data, if not already.
8. Since these are your only copy of the files. Never use the USB stick in an internet cafe until some sort of backup is made.
9. It appears that you haven't given all the valuable details to those you have been asking for help.

Sorry to be so harsh, but you clearly are messing with something you shouldn't be attempting.

Edited April 27, 2011 by BB1950

[Jiu-Jitsu]

Was it not possible to transfer your files to the hard disc drive of a PC, format the drive and replace the files?

Try using Recuva on a friendly PC, retrieve your important files and then run a full format of the USB drive.

Which brand of drive is it? Is it a U3 drive?

[Latindancer]

Thanks BB1960.......points taken.

I only downloadad Panda after my USB got the virus.

Was it not possible to transfer your files to the hard disc drive of a PC, format the drive and replace the files?

Try using Recuva on a friendly PC, retrieve your important files and then run a full format of the USB drive.

Which brand of drive is it? Is it a U3 drive?

Yes.....I could do that. It's a safe way of doing things.

I don't know what a U3 drive is........my USB is a Sandisk Cruzer micro 4gb.

For everyone's information, I just got an interesting answer to a thread about this I also created on Majorgeeks ( a great site ! )

I'll paste it here :

Re: Voaheax.exe virus on my USB thumb drive

Insert your flash drive before you begin. Hold down the Shift key when inserting the flash drive until Windows detects it to bypass the autorun feature. This will keep the autorun.inf from executing automatically.

Please have all your removable storage devices ready for disinfection.

Download Flash Disinfector by sUBs and save it to your desktop.

* Double-click Flash_Disinfector.exe to run it.

* Your desktop and icons may disappear. This is normal.

* It will do a cleanup of removable storage devices, and write a protected Autorun.inf file to help prevent re-infection.

* Follow any prompts that may appear.

* The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.

* Wait until it has finished scanning and then exit the program.

* There will be no GUI interface or log file produced.

* Reboot your computer when done.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder. It will help protect your drives from future infection. __________________

Edited April 28, 2011 by Latindancer

[Latindancer]

Oh dang.....it didn't work.

I did manage to somehow download (possibly by holding down the shift key) all the photos onto a computer in this internet cafe, but cannot download any documents ( OR photos ) when I click on the icons displayed when I plug in my flash drive. They are shown as shortcuts, and when trying to open files, I get an error message saying "the item 'voaheax.exe' that this shortcut refers to has been changed or moved, so that this shortcut will no longer work properly".

Any other suggestions would be most welcome.

[Jiu-Jitsu]

Have you used Recuva as suggested?

Before you do so;

Open Windows Explorer(not Internet Explorer)

1. go to Tools

2. click Folder Options

3. click on the View tab

4. Remove the tick from 'Hide protected operating system files'

5. Go back to your removable device in order to check if anything has changed

If that doesn't work, you can try working through a Live CD.