Remove A USB Worm That Disables Autorun

A USB worm can move from one Windows computer to another when an infected flash drive is plugged in. It may hide genuine folders, create shortcut files, alter registry settings, or attempt to launch malware through AutoPlay and removable-media commands. A drive that looks empty while showing unfamiliar .lnk, .vbs, .bat, or executable files deserves careful treatment.

The safest approach is to contain the infection before opening files, scan both the computer and every connected drive, then restore damaged settings. This guide suits home users, small Australian businesses, schools, and anyone who regularly swaps USB sticks between a work PC, a TAFE computer, a print shop, or a mate’s laptop.

Disconnect And Contain The Infection

Remove the suspected USB drive without opening it again. If files on the computer are actively changing, disconnect the PC from Wi-Fi and Ethernet as well. This can limit communication with other devices and stop the worm from reaching shared folders. Do not plug additional flash drives or external hard disks into the machine while investigating.

If the USB device contains important work, avoid copying its contents to another computer. Write down the drive letter and any unusual symptoms, such as folders becoming shortcuts, files disappearing, or a new executable appearing after insertion. On a business network, tell the administrator promptly; an infected drive used between a Brisbane office and a home workstation can expose shared resources in both places.

Scan Windows And Removable Media

Update Microsoft Defender or another reputable security product, then run a full system scan. Include removable drives if the security application provides that option. For a persistent infection, use Microsoft Defender Offline, which restarts Windows and checks the system before many malicious processes can load. Safe Mode can also help when the worm repeatedly relaunches during normal startup.

After the computer is clean, reconnect the USB drive only when the security tool is ready to scan it. Keep the drive unopened in File Explorer until the scan finishes. Additional guidance about malware checks, startup items, and security cleanup tips can help when the infection has changed more than the USB contents.

Inspect Hidden Files Without Launching Malware

Turn on File Explorer’s options to display hidden files and protected operating-system files, but do not double-click unfamiliar items. Worms commonly hide real directories and replace them with shortcuts that run malicious code first. Suspicious examples include autorun.inf, random-name .exe files, scripts, and shortcuts that point to a location outside the USB drive.

Use Windows Terminal or Command Prompt carefully to inspect the device. After identifying the correct drive letter, commands such as attrib -h -r -s /s /d X:\*.* may restore hidden, read-only, and system attributes, with X: replaced by the USB letter. This command does not remove malware, so scan the drive before opening restored folders. Never run commands against a drive letter you have not confirmed.

Disable Autorun And Repair Settings

Modern Windows versions generally restrict automatic program execution from USB media, but AutoPlay can still display prompts that tempt users to open files. Set AutoPlay to “Ask me every time” or turn it off in Settings. In supported editions, Local Group Policy can disable AutoPlay for all drives by enabling the policy that turns off AutoPlay.

Windows Home users can apply the same protection through carefully edited registry settings, but a mistake there can affect the system. Create a restore point and back up the registry before changing it. Also check Task Manager’s Startup apps, scheduled tasks, browser extensions, and unusual services for entries created around the time the worm appeared. Remove only items confirmed as malicious, preferably after a security scan identifies them.

Clean Or Reformat The USB Drive

If the files are replaceable, the most dependable fix is to copy nothing from the infected drive, scan it, and reformat it. Right-click the correct USB volume in File Explorer and choose Format, selecting a suitable file system such as exFAT for broad compatibility. Formatting erases the contents, so confirm the drive letter and preserve essential documents elsewhere first.

When files must be recovered, scan them before opening and copy only known documents, photographs, or other required data. Avoid transferring shortcuts, scripts, executables, or unknown folders. Afterward, safely eject the drive and test it on a fully patched computer with automatic launching disabled. For wider recovery and prevention guidance, the Pc Malware Expert resource covers threats affecting Windows and Mac systems.

Prevent Another USB Infection

Keep Windows, browsers, security software, and applications updated, and use a standard user account for everyday work. Treat free USB sticks, promotional drives, and devices exchanged at markets, libraries, universities, or Australian workplaces as untrusted until scanned. A USB borrowed for printing at a local copy shop can carry the same risk as one used between office computers.

Label personal drives and avoid sharing them casually. Encrypt sensitive material, maintain separate backups, and eject media properly before removal. If a drive repeatedly recreates malicious files after reformatting, stop using it and replace it; the computer or another connected device may still be infected. These habits reduce the chance that a shortcut-spreading worm will get another opportunity to travel.