A user may clean a drive and, after reconnecting it to the same PC, find shortcuts or hidden files again. This sequence calls for investigating the relationship between the drive and Windows processes.
Two areas to investigate
The drive contains files and possible shortcuts; Windows may contain running scripts, startup components or related tasks. A complete diagnosis examines both sides rather than assuming the USB is the only source.
Clues of a recurring chain
Shortcuts recreated after cleaning, several USB drives showing symptoms on one computer or repeated execution of unknown scripts are clues worth correlating. No single clue proves the same malware family.
How to interrupt the sequence safely
Stop moving devices between machines, preserve data and reports, scan Windows and the affected drive, remediate only the confirmed chain and rescan before normal use.
Laboratory results
ANTÍDOTO V1.6.3 validated removal of observed persistence and components in controlled MAYUNDO scenarios, with clean rescans for tested indicators. A new incident still requires case-by-case evaluation.
Related reading
- Formatted the USB drive but it returned? MAYUNDO may persist in Windows
- MAYUNDO and RunHelper: understanding Windows persistence
A safer scan with ANTÍDOTO
If you recognize these symptoms, you can download ANTÍDOTO and run a free scan of Windows and external devices. Review the findings before deciding on remediation, which requires a license. See the licensing plans and Resource Center. Detections and outcomes depend on the individual case.