USB flash drives and portable hard disk drives are commonplace today as PCs and digital media are conquering the market. But, while ease of use and portability of the UFD and HDD [as well as their digital content] increases, the spread of malware on them also increases. There are several ways to prevent this from happening, with or without the help of an AV product.
Case 1: Clean PC+AV, Infected UFD/HDD; Automatic
This is the easiest, though not necessarily the best solution to detect and clean autorun-driven malware.
- Update the anti-virus product on your computer before plugging in the portable drive.
- Do not open your drive contents after plugging.
- Scan your portable drive for malware immediately.
- Clean all infections found by your anti-virus.
Case 2: Clean PC, Infected UFD/HDD; Manual
In some cases, an anti-virus product or an update is not available, or the anti-virus product is just not strong or smart enough. We could do a manual search and destroy for the malware.
- Plug on the drive to your computer.
- Use the Folders Explorer Bar to open the drive contents on Windows Explorer, instead of double-clicking the drive icon on the main window; or
- Right-click on the drive icon on the main window, and select Explore or Open, and not Autoplay or Autorun
- Look for the file named
- Open the file using Notepad or the text editor of your choice.
- Take note of the line that says,
<path\filename.ext>is the location of the malware itself.
- Locate the malware and delete it along with the
Case 3: Infected PC
You would know if your PC is already infected when it copies the malware and the autorun files to your portable drives automatically. If your AV software couldn’t handle cleaning your system from it, or if you have none, consider browsing the Web for manual detection and cleaning procedures as different variants and, therefore, locations of them would be hard to summarize in this post. Try Trend Micro‘s Virus Encyclopedia.
Case 4: Clean PC and UFD/HDD; Prevention
- Create a folder on the root of your portable drive.
- Rename it as
- Right-click on the folder, and click Properties. Alternatively, select the folder, then go to the File menu, and select Properties. KB shortcut:
- Under the General tab, on the Attributes section, check Read-only and Hidden. KB shortcuts:
The above instructions would prevent other infected computers from copying an autorun directive to your portable drive. It doesn’t necessarily mean an instance of the malware itself would be prevented from being copied as well. It just protects you from your own muscle memory of instantly double-clicking the drive icon to open the contents, but instead, running the malware to be installed on your clean PC.
- ^ malicious software; collective term for viruses, worms, trojan horses, spyware, et al.
- ^ Cases assume you’re on the virus-prone Microsoft Windows platform.
- ^ Your AV would probably delete only the instances of the malware and not the
autorun.inffile for it is intended as a convenience feature for legitimate software manufacturers. You could safely delete the autorun file manually.
- ^ This pertains to my experience with a fully-updated AVG Anti-Virus Free Edition on my classmate’s notebook, which was not able to detect a simple autorun-driven malware.
- ^ If not visible by default, go to View on the menu bar, locate Explorer Bar, and then check Folders. KB shortcut:
[Alt]+V, E, O