How to Remove a Virus from a USB Flash Drive Using Command Prompt
Clear the common "shortcut virus" and hidden malware attributes from a USB drive with attrib.
Overview
The "shortcut virus" hides your real files and replaces them with shortcuts on USB drives. Command Prompt can reveal the files and clear the malicious attributes. This guide shows how, plus how to fully clean and protect the drive.
Removing a USB virus with Command Prompt.
Warning: Command Prompt un-hides files but is not a full antivirus. Always follow up with a reputable antivirus scan, and back up important data before cleaning.
Key Takeaways
- The shortcut virus hides files and creates fake shortcuts.
- attrib clears hidden/system/read-only flags to reveal files.
- Follow up with a full antivirus scan.
- Disable Autorun to prevent reinfection.
Step 1: Reveal Hidden Files with attrib
1. Plug in the USB drive and note its drive letter (e.g., E:).
2. Open Command Prompt.
3. Switch to the drive: type E: and press Enter.
4. Run: attrib -h -s -r /s /d *.*
5. Your real files reappear; delete the suspicious shortcut(s) and any unknown .exe/.vbs files.
Step 2: Scan with Antivirus
1. Open Windows Security > Virus & threat protection > Scan options.
2. Choose Custom scan and point it at the USB drive.
3. Quarantine/remove anything detected.
Step 3: Prevent Reinfection (Disable Autorun)
1. Group Policy (Pro): gpedit.msc > Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies > "Turn off Autoplay" > Enabled.
2. Settings: turn off AutoPlay under Settings > Bluetooth & devices > AutoPlay.
3. This stops malware auto-running from removable drives.
Troubleshooting
Problem: Files still hidden after attrib.
Solution: Ensure you targeted the correct drive letter and ran the full command; also enable "Show hidden items" in Explorer.
Problem: Virus keeps coming back.
Solution: Disable Autorun, scan every device you plug in, and clean the source PC that reinfects the drive.
Problem: Should I just format?
Solution: Formatting removes the virus (back up your recovered files first); do a full format for stubborn infections.
Problem: Data missing.
Solution: The files are usually hidden, not deleted — attrib restores them; use recovery software if truly lost.
Conclusion
The attrib command reveals files hidden by the shortcut virus and lets you delete the malicious shortcuts. Always follow with a full antivirus scan and disable Autorun to stop reinfection — and format the drive as a last resort after backing up your recovered data.
