How to Remove a Virus Using Cmd

Last Updated: March 26, 2019

It is common these days to lose your data due to virus affecting you flash drives, memory cards etc. The virus can be removed and the data can be recovered easily by using the command prompt. Just follow the simple steps.

Part 1

Part 1 of 2:

Making sure the data can be recovered

1
Open the drive that contains the virus.
2
Press Ctrl+A to select all.

Advertisement
3
Hit Alt+Enter to view properties.
4
Note the total space consumed by the data of the drive.
5
Compare it to the used space of the drive. If the used space exceeds the total size of the data, then it is possible to recover the lost data.
- In other words, if the drive is showing more space consumed than the actual data inside the drive, then your lost data can be recovered.

Part 2

Part 2 of 2:

Removing virus and recovering data through cmd

1
Press Ctrl+R at the desktop.
2
Type cmd and hit Enter.
3
Type the command: attrib -a -r -h -s /s /d x:\*.*
4
Replace x with the drive letter and hit Enter.
- The drive will now contain a folder without any name. This folder contains your lost data.
5
Delete any unnecessary files that you see such as autorun.inf, recycle.bin etc.
6
Backup your data and format the drive, if possible.

Community Q&A

Question

When you click properties on This PC or My computer, there is "Tools", when you click it, what do "Error Checking" do? Since my laptop always get lag/stuck at desktop after login.

Evan Boehs

Community Answer

Try installing an antivirus if you can, otherwise you will need to identify the file first, and then Search for the CMD in the start menu, press right click on the CMD icon and hit “Run as Administrator” Now, type wmic and hit Enter (c:\Windows\system32>wmic). You will see a wmic:root\cli>. Now type “product get name” (wmic:root\cli>product get name). Now, you will see a list of all programs installed using Windows installer. Now type, product where name=”name of program” call uninstall and press enter. (wmic:root\cli> product where name= “name of program” call uninstall). Also, if you can, open task scheduler and look there to check that it won't run at startup!