Write Protect a Bootable USB Before Using It on an Infected PC
Your toolkit pendrive goes into the dirtiest computers in town. Here is how to stop it becoming the thing that carries the infection to the next customer.
✍️ Technical Anshu💽 Bootable USB Toolkit⏱️ 9 minute read
🎥 Watch the full video — the complete ultimate bootable USB build, shown live step by step
The most dangerous moment in any repair is plugging your clean toolkit into a virus-infected PC. USB malware is designed for exactly this moment — it copies itself onto your drive, hides your real folders, and plants shortcuts that spread it further. The next customer's PC gets infected from your stick, with your name on the job. These are the defences that actually work, in the order a technician should prefer them.
Ultimate USB (E:) — after one visit to an infected PC
📄 Documents.lnk — this shortcut was never yoursSuspicious
⚙️ New Folder.exe — a folder that is really a programSuspicious
📄 autorun.inf — planted to launch malware automaticallySuspicious
📁 PortableApps — your real folders, now hiddenCheck first
☝️ The classic "shortcut virus" pattern — your folders get hidden and fake shortcuts take their place
1
Best Protection — Boot the Sick PC From the USB
The safest plug-in is the one where the infected Windows never gets to run.
Start the customer's PC from your bootable USB into its WinPE or recovery environment
Work from there — scan the internal drive, copy data off, run your tools
Because the infected Windows stayed shut down, nothing in it could write to, hide, or infect your stick
This is the method to prefer for any machine you know or suspect is infected
2
If You Must Plug Into a Running Infected Windows
Sometimes booting is impossible (a locked BIOS, a BitLocker prompt nobody knows). Then hardware decides.
Use a USB drive with a physical write-protect switch, switched ON before you insert it — with the switch on, the PC physically cannot write to the drive
No switch on your drive? A microSD card in a USB reader, with the card's lock tab on, gives similar protection on readers that honour the lock
Run only the tools you need, and remove the drive as soon as the job is done
3
The Software Read-Only Trick — Useful, But Know Its Limit
Windows can mark a USB disk read-only with DiskPart:
Open Command Prompt as Administrator and type diskpart
Then list disk, find your USB by size, and select it — for example select disk 2
Apply attributes disk set readonly (remove it later with attributes disk clear readonly)
Honest limit: this setting is remembered by the Windows that set it — it protects the stick on your own PC, for example while you scan a customer's drive. It does not travel to the customer's PC, so it is not protection at their place
4
After Any Risky Visit — Clean and Verify the Stick
On your own clean PC, run a full antivirus scan of the USB before opening anything from it
Look for the infection pattern above: unknown .lnk shortcuts, .exe files wearing folder icons, an autorun.inf you did not create, and your real folders turned hidden
Delete the planted files, unhide your folders, and re-copy any tool whose files look changed — your master backup on the PC makes this painless
Never double-click a strange file found on the stick "just to see what it is". That is how the carrier gets infected
⛔ Read-only by checkbox is not write protection. Marking files read-only in Properties, or running attrib +r, stops nothing — any program, including malware, can clear that flag in a second. Only a physical switch or a PC that never boots the infected Windows truly protects the drive.
🎥 Watch the Complete Build in the Full Video
Making the USB bootable, adding portable software and arranging the ISO files — the entire process is shown live in the video.
It can try. Malware writes to the big data partition where your ISOs and tools live, and files there can be deleted, hidden or replaced. The small boot partition is rarely the target, but nothing on a writable drive is untouchable. This is why a master backup matters — if the menu or tools ever look wrong, rebuild the drive from the clean copy instead of trusting it.
Is setting the USB read-only in DiskPart enough protection?
No — not at the customer's place. The DiskPart read-only attribute is remembered by your own Windows, so it protects the stick on your PC (useful while scanning unknown drives). The customer's Windows does not know about it. For a running infected machine, only a physical write-protect switch gives real protection.
Should I format the USB after every infected PC visit?
Not routinely. If you booted the PC from the stick (the infected Windows never ran) and a full scan on your own PC comes back clean with no suspicious files, the drive is fine. Format and rebuild from your master backup when you actually find planted files — fake shortcuts, a strange autorun.inf, or tools that behave oddly.
This guide is based on the Technical Anshu ultimate bootable USB video • Stuck on any step? Ask in the video comments — help is available there 🙏