[SOLVED] Flash Drive infected with LNK:Runner virus, makes the drive read-only

testsubject2575

Reputable
Dec 26, 2019
135
4
4,595
I plugged my flash drive into someone's computer, not knowing that his PC had a virus named LNK:Runner which creates some .cpl files inside a folder, also creating these shortcuts as shown in the image (Drive.bat is not included, I've fixed that):

View: https://imgur.com/a/1R1P5wW

The virus made my flash drive as read-only drive, which prevents me to format it. There are no applications that is currently using my flash drive.

Luckily I could just copy my entire files into another PC, but some .html files were infected.

I've already tried everything. HDD LL, regedit.exe, diskpart.exe, OTL, Easeus formatting tool, neither of these worked. Help.
 
Last edited:
Solution
I plugged my flash drive into someone's computer, not knowing that his PC had a virus named LNK:Runner which creates some .cpl files inside a folder, also creating these shortcuts as shown in the image (Drive.bat is not included, I've fixed that):

View: https://imgur.com/a/1R1P5wW

The virus made my flash drive as read-only drive, which prevents me to format it. There are no applications that is currently using my flash drive.

Luckily I could just copy my entire files into another PC, but some .html files were infected.

I've already...

USAFRet

Titan
Moderator
The flash drive still works fine though.
Except for working only partially, it works great!

In the commandline (cmd or powershell), try diskpart and the clean all command.

https://www.windowscentral.com/how-clean-and-format-storage-drive-using-diskpart-windows-10

Be absolutely sure which drive you are accessing. There is no going back after doing that.
 
  • Like
Reactions: testsubject2575

madartzgraphics

Reputable
Jun 29, 2019
282
26
4,790
I plugged my flash drive into someone's computer, not knowing that his PC had a virus named LNK:Runner which creates some .cpl files inside a folder, also creating these shortcuts as shown in the image (Drive.bat is not included, I've fixed that):

View: https://imgur.com/a/1R1P5wW

The virus made my flash drive as read-only drive, which prevents me to format it. There are no applications that is currently using my flash drive.

Luckily I could just copy my entire files into another PC, but some .html files were infected.

I've already tried everything. HDD LL, regedit.exe, diskpart.exe, OTL, Easeus formatting tool, neither of these worked. Help.

Ahhh, the good ol Recycler virus :) Do not throw it away as I've cured one before. Here's what I did:

NOTE: Assuming that you've already plugged it on your computer and it's already infected too.

1) Download Rkill from Bleeping Computer and run it to disable those malicious programs running in the background.

2) Attempt to quick format your flash drive. That'll erase everything ofcourse, you have no choice but to format all of them as it is pretty useless by the time it's infected. Assuming that the data is not so important to cause some inconvinience to you.

3) Download Malwarebytes they have a free trial of the premium version (free also works for scanning no worries). Install it and do a full scan, have patience. Make sure you include everything including the flash drive.

4) Download Avast Free Antivirus, that'll safeguard your device from getting another infection. You can run AVAST and MALWAREBYTES side by side no worries.

5) Download USB Disk Security, it blocks malicious programs from the flash drive from autorunning. Safeguarding you from infection and avoiding spread of the said virus.

6) Check your flash drive again if it came back. Try to reformat it again just to make sure and then restart your PC. Voila.

Last but not the least, don't be afraid to have doubts on someone's computer. Never ever put your flash drive again from an unknown device. Never trust a computer. I have that friend, you won't believe it he's a tech master but hell his computer was full of virus without him knowing (including Stuxnet, the virus that almost caused world war 3). I found it out by scanning it thoroughly.

IMPORTANT: You need to understand that as long as your computer and your flash drive is infected you will never cure the flash drive itself as it'll just repeat itself over and over again. Also, do not plug it into another device, that device will also get the virus. It will lurk on every device you have so please do not do that. You need to scan all of the computers you;ve placed this device on or it will never resolve.
 
Last edited:
  • Like
Reactions: testsubject2575
Solution

testsubject2575

Reputable
Dec 26, 2019
135
4
4,595
Ahhh, the good ol Recycler virus :) Do not throw it away as I've cured one before. Here's what I did:

NOTE: Assuming that you've already plugged it on your computer and it's already infected too.

1) Download Rkill from Bleeping Computer and run it to disable those malicious programs running in the background.

2) Attempt to quick format your flash drive. That'll erase everything ofcourse, you have no choice but to format all of them as it is pretty useless by the time it's infected. Assuming that the data is not so important to cause some inconvinience to you.

3) Download Malwarebytes they have a free trial of the premium version (free also works for scanning no worries). Install it and do a full scan, have patience. Make sure you include everything including the flash drive.

4) Download Avast Free Antivirus, that'll safeguard your device from getting another infection. You can run AVAST and MALWAREBYTES side by side no worries.

5) Download USB Disk Security, it blocks malicious programs from the flash drive from autorunning. Safeguarding you from infection and avoiding spread of the said virus.

6) Check your flash drive again if it came back. Try to reformat it again just to make sure and then restart your PC. Voila.

Last but not the least, don't be afraid to have doubts on someone's computer. Never ever put your flash drive again from an unknown device. Never trust a computer. I have that friend, you won't believe it he's a tech master but hell his computer was full of virus without him knowing (including Stuxnet, the virus that almost caused world war 3). I found it out by scanning it thoroughly.

IMPORTANT: You need to understand that as long as your computer and your flash drive is infected you will never cure the flash drive itself as it'll just repeat itself over and over again. Also, do not plug it into another device, that device will also get the virus. It will lurk on every device you have so please do not do that. You need to scan all of the computers you;ve placed this device on or it will never resolve.
It didn't infect the thing, I guess it is stuck in my flash drive. I'll try this and hope that it will work. thanks!
 

madartzgraphics

Reputable
Jun 29, 2019
282
26
4,790
It didn't infect the thing, I guess it is stuck in my flash drive. I'll try this and hope that it will work. thanks!
I doubt that conclusion unless scanned. I found a Stuxnet lurking on my tech master friend's computer without him being aware of. That's the virus that crippled Iran's nuclear power plant. The recycler virus is also one of the detection i've discovered so don't be too over confident about it.

The way it travel is:
USB > PC > USB > PC > USB > PC
 
  • Like
Reactions: testsubject2575

madartzgraphics

Reputable
Jun 29, 2019
282
26
4,790
It didn't infect the thing, I guess it is stuck in my flash drive. I'll try this and hope that it will work. thanks!

Read this:
https://forum.avast.com/index.php?topic=81444.0
and
https://threatpost.com/stuxnet-lnk-exploits-still-widely-circulated/125089/

LNK:Runner is suspected on this thread to be linked with Stuxnet Virus.

My original solution will solve that issue. Do not forget to do all of the steps i've provided especially the Rkill, Malwarebytes Full Scan and USB Disk Security. That's the key to it. After that, Avast will do the permanent protection for you after cleaning every device you have.

Are you running an old unpatched machine? OId machines are prone to Stuxnet, the new ones are patched but updated antivirus will help you with that problem anyways so no issue right there.

If I remember it right, both virus was detected (Stuxnet and Recycler) when I fixed these issues my friend was having, same as yours.
 
Last edited:
  • Like
Reactions: testsubject2575