This is a step by step guides on how to recover a virus infected thumb drive using Linux operating system. If a normal virus, we can just delete the virus file and related directories from the thumb drive. However, if the thumb drive has been infected by some viruses that created a read only files and input output error, that's trouble. This tutorial is a guide for those who need to fix this kind of problem. For this example, an input output error virus infected thumb drive and Ubuntu Desktop as Linux operating system are used.

A thumb drive automatically detected and mounted in Ubuntu Desktop by default. If you change the configuration or if you are using other Linux distribution such as Slackware, you need to manually mount the thumb drive. See How to mount and unmount usb drive or thumb drive in Linux tutorial if you need help on this issue.

Ubuntu Desktop opens the thumb drive directory if it has been successfully mounted. Click View menu and choose Show Hidden Item to view all files in the thumb drive. This tutorial shows a thumb drive that has been infected by viruses but cannot be cleaned. It has been deleted using Linux and all the infected files have been moved to .Trash-1000 directory. When we open the '.Trash-1000' directory, we can see two sub-directories, 'files' and 'info'. See the example picture below:

If we try to delete those files, we'll get the 'Read Only' error. See example picture below:

Now, open a command line terminal to see all the permissions in detail. We need root permission to complete this job, so type sudo su and enter your password if hate to type 'sudo' and provide password each time you need root privilege later. See the example below:

kkcjlab@kkcjlab-server:~$ sudo su
[sudo] password for kkcjlab: 
root@kkcjlab-server:/home/kkcjlab#

Change into the thumb drive directory which is the /media/disk. Use Linux 'ls -al' command to view all files including hidden files. See all the steps in the example below:

root@kkcjlab-server:/home/kkcjlab# cd /media/disk/
root@kkcjlab-server:/media/disk# ls -al
total 1656
drwx------ 4 kkcjlab root    4096 1970-01-01 07:30 .
drwxr-xr-x 4 root    root    4096 2010-04-07 11:16 ..
drwx------ 2 kkcjlab root    4096 2010-03-07 18:04 B Borang Berkaitan Tugas Rasmi
-rwx------ 1 kkcjlab root 1679360 2010-02-04 01:04 ELM 2005A.xls
drwx------ 4 kkcjlab root    4096 2010-03-07 11:09 .Trash-1000
root@kkcjlab-server:/media/disk# 

Let's see what happen when a thumb drive has been infected by viruses. The picture below shows the 'handout' directory that has been infected by a viruses viewed in GUI or x-window:

This is what it looks like when we view using a command line terminal:

root@kkcjlab-server:/media/disk/.Trash-1000/files/kursus-joomla/handout# ls -al
ls: cannot access ═èu*E."╬╞: Input/output error
ls: cannot access 4ì

7wïF.