How to Remove Malware from a USB Drive (Without Infecting the PC You Use to Clean It)

The dangerous moment is not the scan. It is the five seconds after you plug the drive in.

USB malware is written on the assumption that you will open the drive to look at it. Do that on your main machine and the infection has already moved before any antivirus reports anything. So the order of operations matters more than which tool you use.

Do this before you plug it in

Disable AutoPlay and AutoRun. On Windows 11, Settings → Bluetooth & devices → AutoPlay, switch it off. Modern Windows no longer executes autorun.inf automatically from removable drives, but AutoPlay can still open the folder - and opening the folder is exactly what some payloads wait for.

Decide which machine does the cleaning. Ideally not the one holding your data. A spare laptop, or a Linux live USB booted on any machine, both work: Linux will not execute a Windows payload, which makes it a genuinely safer place to inspect a suspect drive.

Step 1 - Scan without opening

Plug the drive in and do not double-click it in File Explorer. Right-click the drive letter and choose your antivirus’s scan option, or point Windows Security at it: Windows Security → Virus & threat protection → Scan options → Custom scan, then select the drive.

If something is found, let it quarantine, then scan again. A second pass matters: removing one component sometimes reveals another that was hidden by it.

A drive that looks empty is not evidence of anything. The most common USB infection hides your files and shows you shortcuts instead.

Step 2 - Recognise the shortcut trick

This is the classic and it fools people every time: you open the drive and your folders are now shortcuts, or the drive looks empty although it reports being full.

Your files are not gone. The malware set them to hidden and system, and placed a shortcut in their place - each shortcut launching the payload and then opening your real folder, so the trick appears to work.

To see the truth, in File Explorer enable View → Show → Hidden items, and untick Hide protected operating system files in the folder options. Your real folders should reappear.

Do not click the shortcuts, even to check. That is the payload.

Step 3 - Recover the files, then reset the attributes

Copy your real files off the drive to a scanned, quarantined folder on the clean machine - and scan that folder again before opening anything. Documents can carry macros; the fact that they came back does not make them safe.

If the attributes are still wrong after copying, a command prompt fixes them in one line, run against the drive letter:

attrib -h -r -s /s /d E:\*.*

Replace E: with your drive. This clears the hidden, read-only and system flags recursively - it does not remove malware, it only undoes the concealment.

Step 4 - Format, and be honest about why

Once your files are off and scanned, format the drive. Not a quick format if you can afford the time: full format.

This is the part people resist, and the reasoning is worth stating plainly. A USB stick costs a few euros. Your certainty that every trace is gone is worth more than that, and a scan that finds nothing is not proof of cleanliness - it is proof that your scanner did not recognise anything. Formatting removes the doubt.

The one case where formatting is not enough: malware that infects the drive’s firmware rather than its filesystem. It is rare, it is not something a consumer can detect, and the answer is to physically discard the drive. If you have any reason to think you were specifically targeted - a drive found in a car park, a drive handed to you at a conference - do not clean it. Throw it away.

Step 5 - Check the machine you used

If you opened the drive before scanning it, treat the computer as suspect too. Run a full offline scan - Windows Security → Scan options → Microsoft Defender Antivirus (offline scan) - which reboots into a minimal environment where malware that hides from a running system cannot.

What actually prevents this

Autorun-based spread is far weaker than it was a decade ago, but USB remains a favourite route into machines that are not connected to anything - which is precisely why it is used against industrial and air-gapped systems.

Three habits cover most of it: keep AutoPlay off, never open a drive whose origin you do not know, and scan before opening rather than after. And if a drive has been infected once, remember that the person who handed it to you probably still has whatever infected it.

The short version

Turn off AutoPlay, scan before opening, expect the shortcut trick and reveal hidden files rather than clicking anything, copy your files off and scan them again, then format the drive fully. If you suspect a targeted attack or firmware-level infection, throw the drive away - and scan the computer you used, offline.