Saturday, 16 May 2015

How to Remove Shortcut Virus From Pendrive / USB Drive

If your USB drive don’t have important files you can try to Format it, but if it contains important files then you are not going to format it, to Remove Shortcut Virus follow the Steps Below.
Step 1. Go to Start and Search for cmd , as it appears in start menu Right Click on it and Click on “Run as Administrator“
Step 2. Navigate to Flash Drive by typing its letter. [ Lets Say it is i ], to find your USB drive letter open “My Computer” and check for letter, type i: and hit enter.
Step 3. Type ” del *.lnk ” (without quote) in cmd window and Hit Enter on your Keyboard.
Step 4. Now type ” attrib -s -r -h *.* /s /d /l ” ( without quote ) and hit Enter .

It will take few seconds to recover all your files, Now open your Flash Drive you will get Back all of your files.
Once you recover files into USB drive you can use them but if you again plug in USB Flash drive into infected computer your flash drive will infect again, so it is better to remove source of this virus i,e infected computer, follow the steps below to remove shortcut virus from computer.
Step 1. First open Task Manager by pressing Ctrl + Alt + del Or Right Click on taskbar and click on Task manager.
Step 2. Go to Process tab and look for process Wscript.exe , Scroll down and find any such process, Now Right Click on it and Click on End Task.
Step 3. Now go to Start and search for “regedit” , open it you will get Registry Editor navigate to
HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Run
Here look for Registry Key “XYZ name” if found then right click on it and delete this registry key. This will remove Shortcut Virus from your Computer, if not then try these steps.

1. Press windows + R key, you will get Run box, type %temp% here and hit OK, now temp folder will be open look for file xyz.vbs or xyz.exe or any kind of script and delete it.

2. Go to C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. Check Startup folder if xyz.vbs exist here then delete it.