Reply to thread

Message

<blockquote data-quote="TheMalwareMaster" data-source="post: 815884" data-attributes="member: 47679">Yeah, I noticed the latest Mcshield database update was of 2016, but it basically worked and removed some residual lnk files (maybe the worm was old). Just remove any lnk file on your pendrive and you are ok. Then, the worm was already cleaned by Windows Defender so there was not much work to do, and I had autorun and windows script host disabled on that machine using a registry tweak.Here you have a guide with all the steps[URL unfurl=&quot;true&quot;]https://promotionaldrives.com/blog/how-to-get-rid-virus-usb/amp[/URL]Do you know other alternatives? I will take a look at USBFix.In any case, it&#039;s not recommended to insert again a flash drive in a windows computer (if you aren&#039;t 100% sure that the worm was already cleaned by an AV), as it may get infected. Just use a linux machine or live ISO.In my case, I was almost sure the infection was gone (as it was), but in any case I had autorun and windows script host disabled, as well as Vodooshield realtime, MCshield and other second opinion scanners realtime (Zemana and Malwarebytes), which were installed just to check the USB and then removed. So in case the malware was still present, there was no risk of infection (especially because of autorun and windows script host disabled)</blockquote>

[QUOTE="TheMalwareMaster, post: 815884, member: 47679"] Yeah, I noticed the latest Mcshield database update was of 2016, but it basically worked and removed some residual lnk files (maybe the worm was old). Just remove any lnk file on your pendrive and you are ok. Then, the worm was already cleaned by Windows Defender so there was not much work to do, and I had autorun and windows script host disabled on that machine using a registry tweak. Here you have a guide with all the steps [URL unfurl="true"]https://promotionaldrives.com/blog/how-to-get-rid-virus-usb/amp[/URL] Do you know other alternatives? I will take a look at USBFix. In any case, it's not recommended to insert again a flash drive in a windows computer (if you aren't 100% sure that the worm was already cleaned by an AV), as it may get infected. Just use a linux machine or live ISO. In my case, I was almost sure the infection was gone (as it was), but in any case I had autorun and windows script host disabled, as well as Vodooshield realtime, MCshield and other second opinion scanners realtime (Zemana and Malwarebytes), which were installed just to check the USB and then removed. So in case the malware was still present, there was no risk of infection (especially because of autorun and windows script host disabled) [/QUOTE]

Verification