[SOLVED] Flash Drive infected with LNK:Runner virus, makes the drive read-only

[testsubject2575]

I plugged my flash drive into someone's computer, not knowing that his PC had a virus named LNK:Runner which creates some .cpl files inside a folder, also creating these shortcuts as shown in the image (Drive.bat is not included, I've fixed that):

https://imgur.com/a/1R1P5wW

View: https://imgur.com/a/1R1P5wW

The virus made my flash drive as read-only drive, which prevents me to format it. There are no applications that is currently using my flash drive.

Luckily I could just copy my entire files into another PC, but some .html files were infected.

I've already tried everything. HDD LL, regedit.exe, diskpart.exe, OTL, Easeus formatting tool, neither of these worked. Help.

 

[USAFRet]

Much as the doctor does with an infected needle after using it...toss it.

And please be sure to check whatever systems you plugged this drive into.

 

[testsubject2575]

Much as the doctor does with an infected needle after using it...toss it.

And please be sure to check whatever systems you plugged this drive into.

The flash drive still works fine though.

 

[USAFRet]

The flash drive still works fine though.

Except for working only partially, it works great!

In the commandline (cmd or powershell), try diskpart and the clean all command.

How to Diskpart Erase/Clean a Drive Through the Command Prompt | Seagate Deutschland

This article explains the Microsoft Diskpart Erase utility. The command that erases the drive during this process is "Clean". In this article "Clean" and erase are used interchangeably. Cleaning or erasing a storage device removes all data and partitions from the drive.

www.seagate.com

https://www.windowscentral.com/how-clean-and-format-storage-drive-using-diskpart-windows-10

Be absolutely sure which drive you are accessing. There is no going back after doing that.

 

[testsubject2575]

Can't do the active command, diskpart says "There is no partition selected".

 

[USAFRet]

Can't do the active command, diskpart says "There is no partition selected".

Where in the process are you doing this?

You can't make a partition 'active' that does not yet exist.

 

[testsubject2575]

Where in the process are you doing this?

You can't make a partition 'active' that does not yet exist.

I typed this:

diskpart
lis dis
sel dis 7 (this is where my usb drive is located)
active

"There is no partition selected"

I guess the diskpart forgets which drive I have selected.

 

[USAFRet]

Basically, this:

From a command window:

Diskpart

list disk
select disk X (where X is the flash drive)
clean all
create partition
format
assign letter=d (or whatever)

 

[testsubject2575]

Basically, this:

From a command window:

Diskpart

list disk
select disk X (where X is the flash drive)
clean all
create partition
format
assign letter=d (or whatever)

Will it only clean the drive I have selected?

 

[USAFRet]

I typed this:

diskpart
lis dis
sel dis 7 (this is where my usb drive is located)
active

"There is no partition selected"

I guess the diskpart forgets which drive I have selected.

At that point you had not selected a partition to work with.
Nor do you need to at that point.

clean all

 

[USAFRet]

Will it only clean the drive I have selected?

Yes.

 

[testsubject2575]

Yes.

DiskPart has encountered an error: The request is not supported. See the System Event Log for more information.

 

[USAFRet]

DiskPart has encountered an error: The request is not supported. See the System Event Log for more information.

Are you doing this from an Admin command prompt window?
If so, my first recommendation holds true. Toss it.

 

[testsubject2575]

Are you doing this from an Admin command prompt window?
If so, my first recommendation holds true. Toss it.

I forgot that.

 

[testsubject2575]

Are you doing this from an Admin command prompt window?
If so, my first recommendation holds true. Toss it.

Doesn't work. I need help not toss.

 

[USAFRet]

Doesn't work. I need help not toss.

"clean all", done correctly from an Admin command prompt, is the most destructive method I can think of.

If that is not working, either you're doing it wrong, or that flash drive is well and truly borked.

 

[USAFRet]

OK...the second most destructive.
You could give DBAN a try.

Darik’s Boot and Nuke – DBAN

Erase hard drives, desktops, laptops or servers free with a Darik's Boot and Nuke (DBAN) download. Try it now.

dban.org

 

[testsubject2575]

OK...the second most destructive.
You could give DBAN a try.

Darik’s Boot and Nuke – DBAN

Erase hard drives, desktops, laptops or servers free with a Darik's Boot and Nuke (DBAN) download. Try it now.

dban.org

I"ll try it later. Thank you for the information.

 

[madartzgraphics]

I plugged my flash drive into someone's computer, not knowing that his PC had a virus named LNK:Runner which creates some .cpl files inside a folder, also creating these shortcuts as shown in the image (Drive.bat is not included, I've fixed that):

https://imgur.com/a/1R1P5wW

View: https://imgur.com/a/1R1P5wW

The virus made my flash drive as read-only drive, which prevents me to format it. There are no applications that is currently using my flash drive.

Luckily I could just copy my entire files into another PC, but some .html files were infected.

I've already tried everything. HDD LL, regedit.exe, diskpart.exe, OTL, Easeus formatting tool, neither of these worked. Help.

Ahhh, the good ol Recycler virus Do not throw it away as I've cured one before. Here's what I did:

NOTE: Assuming that you've already plugged it on your computer and it's already infected too.

1) Download Rkill from Bleeping Computer and run it to disable those malicious programs running in the background.

2) Attempt to quick format your flash drive. That'll erase everything ofcourse, you have no choice but to format all of them as it is pretty useless by the time it's infected. Assuming that the data is not so important to cause some inconvinience to you.

3) Download Malwarebytes they have a free trial of the premium version (free also works for scanning no worries). Install it and do a full scan, have patience. Make sure you include everything including the flash drive.

4) Download Avast Free Antivirus, that'll safeguard your device from getting another infection. You can run AVAST and MALWAREBYTES side by side no worries.

5) Download USB Disk Security, it blocks malicious programs from the flash drive from autorunning. Safeguarding you from infection and avoiding spread of the said virus.

6) Check your flash drive again if it came back. Try to reformat it again just to make sure and then restart your PC. Voila.

Last but not the least, don't be afraid to have doubts on someone's computer. Never ever put your flash drive again from an unknown device. Never trust a computer. I have that friend, you won't believe it he's a tech master but hell his computer was full of virus without him knowing (including Stuxnet, the virus that almost caused world war 3). I found it out by scanning it thoroughly.

IMPORTANT: You need to understand that as long as your computer and your flash drive is infected you will never cure the flash drive itself as it'll just repeat itself over and over again. Also, do not plug it into another device, that device will also get the virus. It will lurk on every device you have so please do not do that. You need to scan all of the computers you;ve placed this device on or it will never resolve.

 

[testsubject2575]

Ahhh, the good ol Recycler virus Do not throw it away as I've cured one before. Here's what I did:

NOTE: Assuming that you've already plugged it on your computer and it's already infected too.

1) Download Rkill from Bleeping Computer and run it to disable those malicious programs running in the background.

2) Attempt to quick format your flash drive. That'll erase everything ofcourse, you have no choice but to format all of them as it is pretty useless by the time it's infected. Assuming that the data is not so important to cause some inconvinience to you.

3) Download Malwarebytes they have a free trial of the premium version (free also works for scanning no worries). Install it and do a full scan, have patience. Make sure you include everything including the flash drive.

4) Download Avast Free Antivirus, that'll safeguard your device from getting another infection. You can run AVAST and MALWAREBYTES side by side no worries.

5) Download USB Disk Security, it blocks malicious programs from the flash drive from autorunning. Safeguarding you from infection and avoiding spread of the said virus.

6) Check your flash drive again if it came back. Try to reformat it again just to make sure and then restart your PC. Voila.

Last but not the least, don't be afraid to have doubts on someone's computer. Never ever put your flash drive again from an unknown device. Never trust a computer. I have that friend, you won't believe it he's a tech master but hell his computer was full of virus without him knowing (including Stuxnet, the virus that almost caused world war 3). I found it out by scanning it thoroughly.

IMPORTANT: You need to understand that as long as your computer and your flash drive is infected you will never cure the flash drive itself as it'll just repeat itself over and over again. Also, do not plug it into another device, that device will also get the virus. It will lurk on every device you have so please do not do that. You need to scan all of the computers you;ve placed this device on or it will never resolve.

It didn't infect the thing, I guess it is stuck in my flash drive. I'll try this and hope that it will work. thanks!

 

[madartzgraphics]

It didn't infect the thing, I guess it is stuck in my flash drive. I'll try this and hope that it will work. thanks!

I doubt that conclusion unless scanned. I found a Stuxnet lurking on my tech master friend's computer without him being aware of. That's the virus that crippled Iran's nuclear power plant. The recycler virus is also one of the detection i've discovered so don't be too over confident about it.

The way it travel is:
USB > PC > USB > PC > USB > PC

 

[madartzgraphics]

It didn't infect the thing, I guess it is stuck in my flash drive. I'll try this and hope that it will work. thanks!

Read this:
https://forum.avast.com/index.php?topic=81444.0
and
https://threatpost.com/stuxnet-lnk-exploits-still-widely-circulated/125089/

LNK:Runner is suspected on this thread to be linked with Stuxnet Virus.

My original solution will solve that issue. Do not forget to do all of the steps i've provided especially the Rkill, Malwarebytes Full Scan and USB Disk Security. That's the key to it. After that, Avast will do the permanent protection for you after cleaning every device you have.

Are you running an old unpatched machine? OId machines are prone to Stuxnet, the new ones are patched but updated antivirus will help you with that problem anyways so no issue right there.

If I remember it right, both virus was detected (Stuxnet and Recycler) when I fixed these issues my friend was having, same as yours.