Remove Viruses From USB Flash Drive: 7 Ways

To remove viruses from a USB flash drive, you need to scan it with antivirus software, delete or quarantine detected threats, and often clear hidden autorun files that carry the infection. The most reliable approach combines a full system scan, a targeted USB scan, and using the Command Prompt to remove stubborn hidden files. Below are seven practical methods, from the simplest to the most thorough, so you can clean your drive and protect your computer.

Why USB Drives Get Infected

USB flash drives are a common vector for malware because they are portable and often shared between computers. Many viruses, such as the infamous Conficker or VBS/Agent families, spread by creating an autorun.inf file on the drive. When you plug the drive into a Windows PC, the system reads that file and may automatically execute the malicious payload. Even if you disable AutoPlay, the virus can still copy itself to the drive’s root folder, waiting for you to double-click the drive icon and accidentally launch it.

Another reason USB infections persist is that the virus often hides the original files and replaces them with shortcuts or executable files with the same name. For example, a folder named Documents might become Documents.exe, while the real folder is hidden. Users who double-click the fake file re-infect their system. Understanding this behavior is key to fully cleaning the drive.

Before You Start: Safety Precautions

Before attempting to remove a virus, take these steps to avoid spreading the infection to your main computer:

• Disconnect from the internet – some malware phones home or downloads additional payloads when online.
• Disable AutoPlay/AutoRun on Windows (Settings > Devices > AutoPlay) so the drive does not launch anything automatically.
• Use a disposable or secondary computer if possible, especially if the drive contains sensitive data or you suspect a serious infection.
• Back up important files to a clean location before scanning, but only if you can do so without executing anything from the drive.

Method 1: Scan with Built-in Windows Defender

Windows 10 and 11 include Microsoft Defender, which can detect and remove most common USB malware. To run a full scan on the drive:

1. Open Windows Security (search for it in the Start menu).
2. Go to Virus & threat protection > Scan options.
3. Select Full scan or Custom scan and choose the USB drive letter (e.g., E:).
4. Click Scan now. The scan may take several minutes depending on the drive size.
5. If threats are found, choose Remove or Quarantine.

If Defender finds nothing but you still suspect an infection, proceed to the next method.

Method 2: Use Third-Party Portable Scanners

If your main antivirus misses the infection, a second opinion from a dedicated USB scanner can help. Tools like Malwarebytes Free or Emsisoft Emergency Kit are designed to be run from a clean computer and scan external drives. Download the scanner to your desktop, run it, and select the USB drive as the target. These tools often detect adware and spyware that traditional antivirus programs overlook.

Always download such tools from their official websites to avoid fake antivirus programs that are themselves malware.

Method 3: Delete Autorun.inf and Hidden Files via Command Prompt

Many USB viruses hide files and create autorun.inf to re-infect. You can manually remove these with Command Prompt. This works even if the virus has hidden your files.

1. Open Command Prompt as Administrator (search cmd, right-click, Run as administrator).
2. Type cd /d X:\ (replace X with your USB drive letter) and press Enter.
3. Type attrib -h -s -r /s /d *.* and press Enter. This unhides all files and removes read-only attributes.
4. Type del autorun.inf and press Enter. If you see other suspicious files like svchost.exe or msvcr71.dll, delete them too, but be careful not to delete legitimate system files.
5. Type del *.lnk if you see many shortcut files that are not real shortcuts.

After this, your original files should be visible again. If they are not, they may be in a hidden folder that the attrib command did not reveal – check with dir /a to see all files.

Method 4: Format the USB Drive (Nuclear Option)

If the virus is deeply embedded or you cannot identify the malicious files, formatting the drive is the surest way to remove all malware. This erases everything, so back up any files you need first (scan them before copying back).

1. Open File Explorer, right-click the USB drive, and select Format.
2. Choose a file system: FAT32 for maximum compatibility (but files over 4GB cannot be stored), NTFS for Windows-only use and large files, or exFAT for both Windows and Mac.
3. Uncheck Quick Format to do a full format, which overwrites the entire drive and is more thorough at removing hidden malware.
4. Click Start and wait for completion.

Note that formatting does not guarantee the drive is 100% clean if the virus resides in the drive’s firmware (rare but possible). For most consumer drives, a full format is sufficient.

Method 5: Use Diskpart Clean (For Stubborn Infections)

If formatting fails or the drive still shows signs of infection, you can use Diskpart to clean the entire drive. This removes all partitions and data, making the drive completely blank.

1. Open Command Prompt as Administrator.
2. Type diskpart and press Enter.
3. Type list disk to see all drives. Identify your USB drive by its size (e.g., Disk 2).
4. Type select disk 2 (replace 2 with your drive number). Be absolutely sure you have the right disk – this erases everything on it.
5. Type clean and press Enter. This removes all partitions and data.
6. Type create partition primary and then format fs=ntfs quick to create a new usable drive.

This method is more thorough than a regular format because it wipes the partition table, which can hide malicious boot sectors.

How to Prevent Future USB Infections

Prevention is better than any cure. Follow these habits to keep your USB drives clean:

• Keep AutoPlay disabled on all Windows computers.
• Scan every USB drive with your antivirus before opening any files, even if it came from a friend.
• Do not plug unknown USB drives into your computer – they are a common way to spread malware in public places.
• Use a USB with a physical write-protect switch if you frequently share files with others. When the switch is on, nothing can be written to the drive, including viruses.
• Regularly back up your USB data to a secure location, so you can format the drive without losing important files.

Frequently Asked Questions

Can a virus survive a USB format?

In most cases, a standard format removes the virus because it overwrites the file system. However, some advanced malware can hide in the drive’s firmware or in a hidden partition that a quick format does not touch. Using a full format or Diskpart clean reduces this risk significantly. For absolute certainty, replace the drive if it is critical.

How do I know if my USB drive has a virus?

Common signs include: files disappearing or becoming shortcuts, the drive showing a very low free space despite few files, new files appearing that you did not create (like autorun.inf or svchost.exe), and your computer acting slow or showing pop-ups after plugging in the drive. Running a full antivirus scan on the drive is the definitive way to check.

Will scanning a USB drive with Windows Defender remove all viruses?

Windows Defender is effective against most known malware, but it is not infallible. If Defender does not find anything and you still see suspicious behavior, try a second scanner like Malwarebytes or manually check for hidden files using the Command Prompt method. No single antivirus catches everything.

Can I recover files after formatting a USB drive that had a virus?

Yes, in many cases you can recover files after a format using data recovery software like Recuva or PhotoRec. However, if the drive was fully overwritten (full format), recovery is less likely. Always try to back up files before formatting. Also, be aware that recovered files may still contain the virus, so scan them before opening.

Is it safe to use a USB drive that has been infected after cleaning?

Yes, if you have performed a full format or Diskpart clean and then scanned the drive with antivirus and found nothing, it is generally safe to use again. However, if the drive was infected with firmware-level malware (extremely rare), it could re-infect. For most users, a clean format is sufficient.

Why does my USB drive show files as shortcuts after a virus?

This is a common trick used by malware. The virus hides your original files and creates shortcut (.lnk) files that point to the malicious executable. When you double-click the shortcut, the virus runs. To fix this, unhide your files using the attrib command as described in Method 3, then delete the .lnk files.

Related

• Fix Modern Apps Not Working After Upgrading to Windows
• How to Get AR Stickers on Any Android
• 24/7 Ambient Stream: Lower CPU with FFmpeg