Cleaning a virus that makes the whole removable disk read-only.

Once before, I’ve encountered a virus that transfers the entire contents of the usb removable disk to a folder with a blank filename, and then creates a self-running link in the root directory that copies the virus to the hard disk, so that it propogates itself to any new removable disk that is connected. But this was a new breed that made the removable usb drive read-only, so much so that most except the most hard core linux utilities would fail to fix it. A friend had handed the disk over to me, requesting me to see if my “linux PC can fix it”.

The command which fixed the write protect status was:

sudo blockdev --setrw /dev/sdc1

This allowed me to remount it as read-write:

sudo mount -o rw,remount /dev/sdc1 /home/joel/usb

so that I could finally run clamscan and fix it:

clamscan --remove /home/joel/usb

To rename the folder with a blank space as name, I simply used:

mv '/home/joel/usb/ ' /home/joel/usb/ab

You are reading this post on Joel G Mathew’s tech blog. Joel's personal blog is the Eyrie, hosted here.