Removing Panda USB Vaccination Without Formatting USB Disk

We have covered Panda USB Vaccine in a previous article. Panda USB Vaccine can protect your USB disks against autorun viruses and malware, by creating a un-removable autorun.inf on the root folder of your USB disk. According to Panda Security, this can be removed only by formatting the USB disk. But there is a workaround.

The technique used by Panda USB Vaccine is that it modifies the file table, making the autorun.inf file inaccessible permanently. We will open the file table and edit it to make the autorun.inf file readable, writable and deletable. Here is the process :

  1. Download a copy of iBored – a free portable hex editor which can edit the disk sectors.
  2. Insert the Panda USB Vaccine protected USB key into USB port of your computer.
  3. Extract the contents of the iBored zip file to a folder. Right-click on iBored.exe and select Run as administrator. iBored must be run with administrator level access because it needs to access the disk sectors.
  4. iBored will show you a list of detected disks attached to your computer. Be careful to select the USB key. Click View to open the disk sector.

    Removing Panda USB vaccination without formatting USB disk

  5. Select the Raw tab by clicking on it as shown. The Raw tab shows the contents of the sector in raw and hex format.

    Removing Panda USB vaccination without formatting USB disk

  6. Press the key combination Ctrl + F to open the find dialog. You can also open the Find dialog by selecting BlockView → Find from the menubar. In the Find dialog, type AUTORUN INF and click Find button as shown :

    Removing Panda USB vaccination without formatting USB disk

  7. iBored will show and highlight the found string. The found hex values are highlighted in green. We have to edit the very next value to the found values. In this case, it is value 42 in hex (I have marked it with an arrow). This value can be different in your case (e.g., it may be 40).

    Removing Panda USB vaccination without formatting USB disk

  8. From the menubar select BlockView → Make Writable to be able to edit this block. You can also press the key combination Ctrl + Shift + M.
  9. Click on the value we want to edit and type 20. This would edit the value from 42 to 20.

    Removing Panda USB vaccination without formatting USB disk

  10. Click on the Save button to save the disk sector. Close iBored window.
  11. That’s it. Now autorun.inf file created by Panda USB Vaccine is accessible, readable, writable and deletable.
  • Worried

    I tried using iBored to undo the write-protection status of my Flash drive (done by using Panda USB vaccine).

    But after i found the Hex, changed it to 20, and clicked enter, a message pops out with the text:
    “Error while writing to \.PhysicalDrive1”

    what does it mean? what can i do?

    • Perhaps you were not running iBored with administrator access.

  • Annonymus

    It is under “Disk” not under “Blockview.

  • Narkocol y Rcnari

    Hey. How is that? I have an autorun.inf blocked and invisible in Kingston USB (NTFS file system). I think that was wrote by Panda AV pay software.

  • If you have Panda Pro, then it can remove the file itself 🙂

    • Narkocol y Rcnari

      Hi Trisha. No, The “Panda USB Vaccine” cannot removing from windows.
      From Linux distribution I could always remove, exception this rare “autorun.inf” that was super-strongly grabbed and hide on USB, even Linux that cannot.
      But, normally that not happen.