Someone plugged an infected USB drive into my PC, and Windows Defender detected and removed the malware. I then ran full and offline scans with Windows Defender, followed by a Malwarebytes scan, and none of them found anything else. However, I still receive a message saying Windows cannot find "C:UsersUserAppDataRoamingUSBDrive.vbs". I tried searching for the script and following removal instructions, but the file no longer seems to exist. Creating a dummy text file with that name appears to stop the popup. Do I need to reinstall Windows, or is there a safer way to confirm the malware and its startup entry are gone?
3 Answers
USB-drive malware commonly creates a startup entry and places a VBScript in the user profile. If every scan is clean and the file is missing, this may only be a leftover startup reference rather than an active infection. Autoruns is often better than manually searching the registry because it checks more persistence locations. Remove the actual startup entry instead of relying on the dummy file.
You probably don't need to reinstall Windows immediately. Keep Windows Defender and Malwarebytes updated, run another full scan, and scan any other USB drives that may have been connected. Also avoid opening unknown shortcuts or scripts from removable drives. Reinstalling becomes more reasonable if scans detect active malware, system files are being changed, or suspicious behavior continues after all startup entries are removed.
The missing-file message usually means the malware itself was deleted, but something is still trying to launch it at startup. Check Task Scheduler, the Startup apps section in Task Manager, and Microsoft Sysinternals Autoruns. Search for "USBDrive.vbs", "wscript", or "cscript" and remove or disable any entry that points to that file. Back up important files before changing registry or startup settings.
I checked the registry, Task Manager, Task Scheduler, and Autoruns, but I can't find the script anymore. The popup stopped after I created the dummy file. Does that mean the trigger may already be gone?
If the popup returns after restarting, keep checking Autoruns with hidden entries and scheduled tasks enabled. A clean scan is reassuring, but the startup reference still needs to be identified if it continues appearing.