Viruses change the attributes of a file or folder, such as the read, write, or execute permission, making such files or folders extremely hard to access. In order to recover a file, we can change the attributes of a file and reset the file’s internal structure. Thats why it is a great tool to know how to remove one using CMD. Amar Shekhar, writer for FossBytes, gives us the low down.
A virus can present itself in your system as a file format that can be hidden from a user, present in a form ‘autorun’ or ‘autoexec’, an exec file or a file with different attribute properties. Examples of such would be, Autorun.inf, Ravmon.exe, New Folder.exe, and svchost.exe. So how do you remove a virus using CMD from any USB ? Assuming you are already on Windows 10 that is.
Using the cmd command called ‘attrib’ command, will change the attributes of a file, folder, or directory responsible for display, setting and removing attributes such as read-only and archive.
Say there is a virus on your drive.
Run command prompt as administrator.
Change the drive to the one with the virus, in the case of the researcher this is the D drive. Then press Enter.
Type attrib and press enter. This command lists all of the files inside the current drive, which makes it easy to identify which is housing the autorun.info virus.
To remove the Virus using CMD, type into your command prompt, attrib -r -a -s -h *.* and press Enter. This removes the read only, archive, system and hidden file attribute from all the files.
- -r is for removing the read-only files
- -a is for removing the archive file
- -s is for removing the system file
- -h is for removing the hidden file
- *.* for all the files with all different types of file extensions
To delete the virus, type del autorun.inf and Enter
- Once you have pressed enter, that file should get deleted from the current drive. In case, you want to delete that file from a USB stick, then you can change your current drive to USB drive current drive in step 2 and follow the commands.
- You can again type ‘attrib’ command to see if the deleted file exists or not. As seen above, it does not exist anymore in the D drive.
- To remove other viruses with extensions such as ‘.ink’, ‘.exe’, just type Del *.ink or Del *.exe respectively to delete those suspicious files.
If you would like to educate yourself in more detail about the information presented in this blog post please visit : http://fossbytes.com
