Background: I have the common Pendrive Shortcut virus(creates a shortcut within the pendrive),

Question: How can I remove it?

Some additional info: There is a hidden .ini file included with the .lnk file in the drive folder. That's not exactly hidden, since it only shows on using the "ls" command at cmd. The file name is something like "~(random character string).ini", where random character strings are like "a3b$%N3a4"

marked as duplicate by Moses, Xavierjazz, allquixotic, Carl B, Tog Dec 22 '13 at 9:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 3
    ...if you remove that file, you break your system. How exactly did you "trace" anything to that file? You can verify and repair system files with sfc /scannow. – Bob Dec 21 '13 at 14:50
  • Hmm...The .lnk shows the path to that file. – Cheeku Dec 21 '13 at 15:01
  • If you have a shortcut that merely runs that file, it's not necessarily an indicator of an issue. Executing rundll32.exe with no arguments does absolutely nothing. It is certainly not a reason to dive in and delete it. Please provide more details - what makes you think this is a virus, and what is the entire shortcut target line? – Bob Dec 21 '13 at 15:03
  • 1
    With all due respect, I would recommend actually using an antivirus software rather than do detective work on your own, considering it's led you to the conclusion to delete crucial system files. – Moses Dec 21 '13 at 15:06
  • @Moses See edits, please! No, it's led me to that conclusion since there exists a malware that creates a file in your system by the name "rundll32.exe". I have faced it before, and deleting it solved the problem. It's just that it was never in system32 folder. – Cheeku Dec 21 '13 at 15:09

CASIR should help you here.( Common And Stubborn Infections Remover )


If that does not help, you can use Kaspersky Rescue Disk to scan and clean your computer while your windows is sleeping. Kaspersky Rescue Disk boots into a Linux Environment and then scans your Windows Installation. This way the virus which is active when windows is running, does not get a chance to interfere when the Kaspersky Rescue is cleaning your computer from a Linux Environment.

  • I was thinking I better switch to Linux, as the virus is present but shows no effect there. – Cheeku Apr 5 '14 at 1:07

try this

Ripara USB


Can sometimes be useful


you can change the owner of the rundll32.exe to your user with Right click -> Properties -> Security Tab -> Advanced -> Owner tab -> Edit -> select your user. then reopen the properties panel and select Security tab -> Edit -> Select the administrator -> tick Full Control. Now you can do whatever you want with the file.

Keep in mind that there is a reason you can't remove the file even as an administrator. It will break your system if you tamper with the file.

  • 5
    NO. NONONONONO. THERE IS ALMOST NEVER A GOOD REASON TO DO THIS. YOU ARE BETTER OFF REINSTALLING THE SYSTEM. I rarely shout like this, but... seriously?!?! – Bob Dec 21 '13 at 14:57
  • Okay! Made an edit! – Cheeku Dec 21 '13 at 15:02
  • why the downvote? i just answered his question (before he edited it), i never said it was a good idea... – Simiil Dec 21 '13 at 15:24
  • As background for the OP: Compare the virus to a list which says "Get a knife from the kitchen drawer, then pry open a locked cabinet". As answer to that you are trying to remove all knives from the kitchen drawer, which is not the solution (and those knives are used for other things which will fail if you remove them). Instead remove the .lnk file. – Hennes Dec 21 '13 at 17:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.