I just put an old flash drive which i used with a windows machine into my linux. I noticed many files, mostly exes which were never visible in windows (my windows does not hide hidden files and extensions). Most of those strange files had malware like names. I changed the properties of these files so that linux would allow me to delete them. It worked and now the drive seems to be fully clean.

If a windows malware in a flash drive can hide itself from windows, can it also hide itself from linux ? If not, then cleaning windows malware on a flash drive becomes easy.

  • 1
    Nothing is impossible.
    – user10211
    Mar 22, 2013 at 1:55
  • Are there any dangers/problems in this strategy ? Mar 26, 2013 at 7:25
  • Should there be some discussion in the answer of wiping the USB stick to ensure its cleanliness? Removing (unlinking) individually identified malware files does not seem thorough really.
    – adric
    Mar 26, 2013 at 15:22
  • A side hint: Usually flash drive malware store an autorun.inf so that when you connect it to another windows, a naive user might have windows automatically execute it. Without an autorun, the mere existence of the malware (specially if they cannot be seen and therefore cannot be clicked by user) on the flash drive doesn't cause a threat. One way I have found against (at least current) flash drive malware is simply to create a directory named autorun.inf in the root of the flash drive. The malware doesn't suspect a directory and cannot write a file with the same name.
    – Shahbaz
    Mar 29, 2013 at 11:26
  • You can easily go through this process in Linux, usually you'll view what you want. If not you can always format, or run a flash scan with MBAM back on Windows or with Wine, which I've found to be more than reliable on more than one occasion. Mar 31, 2013 at 3:47

6 Answers 6


Yes there's a way to hide the a file from Windows' and Linux's file explorers, which is to start the file name with a dot . and set the h and s flags. In Windows that can be done by using the command line

ren file .file
attrib +h +s .file

Now the file cannot be seen by File Explorer, Nautilus, or Konqueror in their default settings on clean machines.

When you plug your flash disk in a Linux machine and open it using Nautilus, you may press Ctrl+H to show all hidden files. A better solution is to use your favorite shell to run this command in the flash disk's mounted directory.

ls -a

Note: If you "clean" the flash drive using Linux and then plug it back in the suspicious Windows machine, you can assume that it's infected again.

Update: I'll try to address your newly expressed concerns from a real-world and practical point of view.

First, in theory. There is a chance that the Linux machine is infected with malware that forces it to hide certain files (namely other malware files). But in reality, the chances are very slim. But like anything in security, you can never be sure.

Practically speaking, plugging your infected flash disk in a Linux machine and removing all the bad files (assuming you do know what all the bad files are) guarantees with a high probability that your flash disk is now clean. As long as you don't plug it back in the infected Windows machine, it's safe to use amongst other clean Windows machines (assuming you are sure about which machines are clean).

  • Do you mean that the flash drive is infected again when you say this - If you "clean" the flash drive using Linux and then plug it back in the suspicious Windows machine, you can assume that it's infected again. ? Mar 26, 2013 at 7:28
  • @FirstNameLastName Yes. If you have plugged it in an infected Windows machine and then cleaned it using a Linux machine, once you plug it back in the Windows machine you can assume it's immediately infected again. So until all your machines are clean, you can always assume that all the flash disks you use on them are infected.
    – Adi
    Mar 26, 2013 at 7:34
  • @FirstNameLastName You seem to be looking for a more practical answer, I tried to address that in the last edit.
    – Adi
    Mar 26, 2013 at 9:49

Malware Windows executable files on a Flash drive make sense only if they get, at some point, executed on a Windows machine. This requires that the files are "visible" to the said Windows, at least from the point of view of the operating system kernel. That the file are not seen through Windows file explorer means that the file explorer is either subverted (i.e. infected with malware of its own), or that it has a serious bug which prevents it from showing files. Either way, if the .exe files are visible from a Linux system but not from a Windows system, then chances are that the Windows system is corrupted. Cleansing the Flash drive is not enough to cure the disease...

Malware which infects both Linux and Windows is extremely rare; thus, it can be surmised, with a pleasantly high probability, that if a given Flash drive seems "empty" from both a Windows system and a Linux system, then it probably is really empty. This does not imply that either machine is itself "clean".

  • yes, the machine may not be clean. But, it would be nice to know if a flash drive will surely be clean if all bad exes/files can be removed inside linux. If true, then we can put other peoples flash in our linux, clean it and then out it in our windows. However, if a file can be hidden such that it is invisible in linux and windows, then we have a problem. Mar 22, 2013 at 7:50
  • If a file has a system flag set (say with attrib +s filename command) and the Explorer's "Hide protected operating files" option isn't disabled in options, then this file will not show in Explorer, but the system or applications won't have any problems reading it. Of course, disabling that Explorer setting should show files with a system flag in the list as well (and will always show with dir /a command), unless something more sinister is happening with your Windows system, as @ThomasPornin pointed out it might.
    – TildalWave
    Mar 26, 2013 at 9:22

There are a couple of ways this could be done, some quite esoteric such as patching the explorer.exe such that it will 'skip out' a specific blacklist of files created by the malware author.

Other methods are quite simple, such as the already mentioned system file attribute.

If this was an NTFS formatted drive, another very popular method amongst amateur malware authors is to use NTFS Alternate Data Streams, which Microsoft in their infinite wisdom decided to hide from both the explorer.exe program and the dir program, making them slightly difficult to dig up without the proper tools.

Only the latter method above, using Alternate Data Streams, will have any effect on Linux. If the proper NTFS kernel modules have not been installed, then ADS' are equally, if not more, difficult to spot on Linux unless you specifically go looking for them.

  • 2
    Downvoters care to comment?
    – lynks
    Apr 1, 2013 at 19:32
  • If the drive is formatted as NTFS, you won't be able to view its contents in Linux without a NTFS driver, so the problem will be quite evident. Depending on the driver used, the ADS can be shown as normal files (with an embedded :), thus being equally easy.
    – Ángel
    Jul 17, 2014 at 13:43

It seems like you want to know how to safely clean the flash drive so there is no malware left on it when it gets plugged back into your windows machine. One guaranteed way to do this is to open up "Gnome Partition Editor" which is available on many linux distributions by default (including Ubuntu).

Warning this will delete all data on your flash drive, back up anything that you want to save from it (but don't back up the malware)

Upon opening this program you should see the various filesystems associated with your computer. Find your flash drive among them. under the options you should choose to reformat the flash drive (I recommend FAT 32 for a new filesystem type. It is the default for most flash drives). Once reformatted, all data should be gone and you should be good to go.

Here's a guide: http://www.ehow.com/how_4929061_format-hard-drive-ubuntu.html Note the drive you're looking for is your flash drive NOT your hard drive

If not, find yourself a copy of DBAN and write straight zeros through your flash drive. Then reformat it as above so you can use it again. This is time consuming and probably unneeded but if you are still worried, this will do the trick.

Guide: http://jesgru37.hubpages.com/hub/How-to-Wipe-a-Hard-Drive-Step-by-Step-Guide again, make sure the drive you're wiping is your flash drive. If something doesn't seem right, DONT DO IT! The changes made here are irreversible.


USB flash drives contain a flash memory controller IC with an integrated CPU and firmware. It is possible in many cases for the firmware to be modified such that a clean file gets switched out with a malware infected version of the file when certain conditions are met, such as access patterns associated with Windows drive access, or x86 system boot up from of USB. It's also possible for the flash drive to change in to any other USB device, such as adding a USB CD-ROM drive along side the flash drive (some flash drive default firmwares support this feature which can be enabled), or changing itself in to a USB keyboard.

It should go without saying that completely erasing the flash drive using generic means won't remove such malware.

These would be very rare and advanced attacks, and other than requiring special tools specific to the flash controller, removing such malware may in some cases be impossible or require a hardware level repair.


You don't have to be afraid of plugging potentially dangerous USB Drive to your Windows system if you configure it properly to prevent automatic infection.

You can, for instance, use gpedit.msc and go to:

- Computer Configuration
\ - Administrative Templates
 \ - Windows Components
  \ - AutoPlay Policies
    - Enable "Turn off AutoPlay" and select "All Drives"

This should prevent automatic infection of your system if a USB Drive with virus is connected. Still must be careful when trying to open the Pen Drive, because doing that by "double clicking the letter" will start the virus anyway. Instead, browse to the drive letter using the Windows Explorer address bar (type "E:\" for instance) and then with Show Extensions of Known file types and View System and Hidden files enabled, I presume you will be able to identify and eliminate potential threats even while using the operational system this virus was designed for.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .