Only shortcuts are displayed on the flash drive. We delete the executable files of the virus on the USB flash drive. A virus that converts files and folders into shortcuts

Various USB drives, SD cards and other data storage devices connected via USB are very convenient devices available to most users. You can take such devices anywhere: to work, on vacation, to a cafe if you work there. This, of course, is all very good, but at some point a problem may occur with the flash drive, which we will talk about today.

I, and most likely other users, had this problem, which was that all documents, folder files on a flash drive turned into shortcuts, there was also a strange folder called .Trashes. You might think that this is some kind of virus that has corrupted all the files on the USB drive. So what to do if the files on the flash drive have turned into shortcuts?

In general, if you try to check a flash drive with an antivirus, there is a chance that it will find something bad there, as happened to me. If this is the case, you can clean up this “bad” stuff. After rebooting the computer, I went into the USB drive and everything remained as it was: the shortcuts remained.

There are many things on the Internet good way solutions to this problem. I will describe it here to help users if they encounter such an unpleasant problem.

1 way

To begin with, in the explorer parameters, this is done in top menu any folder. Next, launch the command line as administrator and enter the following command there:

attrib -h -r -s /s f:\*.*

By the way, don't forget to change f:\ to the letter of your flash drive. It might look like this, for example: attrib -h -r -s /s r:\*.*

After you have done the work, open the flash drive and make sure that the files and folders are present, but the shortcuts may remain, it’s okay, the main thing is that now you can move your files.

Transfer all files that are not shortcuts to another location, for example, to a computer. Now, format the flash drive, then try to scan the USB flash drive again with an antivirus, just in case.

Move necessary files back to the flash drive. After all the above steps, your problem should be resolved.

Second way

If nothing worked out with the first option, then there is another method, which is to create a bat file with the following content:

Now, run it as administrator, after which, running program will prompt you to enter the letter of the flash drive with which the problem occurred. After this, the shortcuts and the virus will be removed from the flash drive, and everything that you had on the flash drive will remain safe and sound.

Sneaked into computers at work interesting virus. It creates a flash drive shortcut on the flash drive itself and when a person connects such a flash drive, he thinks that this is a harmless glitch and launches the shortcut. And the label in turn fulfills malicious code, written down in the properties, and then only opens the folder with the files to the user. Antivirus programs turned out to be powerless, I decided to try to eliminate this trouble on my own.

The virus only spreads through USB flash drives

So, if you go to Google with the request The virus creates a flash drive shortcut on a flash drive we will see special threads on forums (an example of a thread on cyberforum.ru (http://www.cyberforum.ru/viruses/thread970282.html)), where people ask to remove this nonsense.

To eliminate a virus that creates a flash drive shortcut on a flash drive, you need to send computer scan reports, then follow the guru’s recommendations and that’s it. What to do if the entire park is infected? computer equipment? It will be very expensive to send a report for each PC, because... not all employees will be able to do this. Yes, and treating flash drives for everyone without exception is also time-consuming.

As an option, I decided to try to study this virus myself. To do this, install virtual Windows in VirtualBox, infected it with an infected flash drive. Now I'm looking for a universal and simple way clean computers from a virus that creates a flash drive shortcut on a flash drive, and also protect the system from infected USB media.

Protection considerations

Open the contents of a flash drive bypassing the launch of a malicious shortcut

As I said earlier, the virus only spreads through USB devices by running executable code from the shortcut properties. In order to open all hidden files, you can use the following script:

Attrib "*" -s -h -a -r /s /d

Save it as run.bat and keep it handy.

Disable autorun USB devices To disable USB autostart-flash drives and CDs, you need to edit the registry:

1. “Start” - “Run” and write “regedit”;
2. Open the path HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies
3. We go to the Explorer section, and if it doesn’t exist, create it new section and rename it to “Explorer”;
4. In the “Explorer” section, create the NoDriveTypeAutoRun key and enter the key value 0x4 to disable autostart of all removable devices.

When they bring a flash drive with a shortcut in the root, you need

1. copy run.bat to the root of the flash drive and run;
2. after which many will be revealed to us invisible files, including the folder with empty name, where the virus downloaded all the files;
3. open free utility from microsoft Process Explorer and find the link to autorun via CTRL+F, completing this process;
4. Now all that remains is to delete all files from the root except this folder.
5. go to the folder and move its contents to a higher level, i.e. to the root of the flash drive.

That's all I have for now. I hope to please you with new information soon

Virus treatment from the reader (The method does not work. Edited on 10/02/2015)

Thank you very much! I think the information will be relevant for visitors!

By the way, this virus somehow gradually died out in our country. Everyone copied the script that I wrote above to check the flash drive, each time they were cleaned and checked. And they refused to take them from people who always bring infected devices. And so we defeated this infection.

It has been walking around the network and from flash drive to flash drive for quite some time. new type viruses of the same family, simply another Trojan. Infection with them can be immediately detected with the naked eye without any antiviruses, main feature- all the folders on the flash drive have turned into shortcuts.

If there are very important files on the flash drive, the first thing you will do is rush to open all the folders (shortcuts) to make sure that the files are there - this is not worth doing at all! The problem is that these shortcuts contain two commands, the first is to launch and install the virus on the PC, the second is opening your folder.

How to clean a flash drive from such viruses:

Step 1: Show hidden files and folders.

If you have Windows XP, then we perform the following actions: "Start-My Computer-Tools-Folder Options- tab View”:

On the “View” tab, find two parameters and execute: Hide protected system files(recommended) – uncheck Show hidden files and folders – check the switch.

If you have Windows 7, you need to take a slightly different path: “P usk-Control Panel-Folder Options- tab View”.

You need the same options and need to enable them in the same way. Now your folders on the flash drive will be visible, but they will be transparent.

Step 2. Cleaning the flash drive from viruses.

An infected flash drive looks like the image below:

First you need to check what any of the shortcuts launch (they usually launch the same file on the same flash drive). To do this, you need to look at the properties of the shortcut, where you will find a double launch - the first opens your folder, and the second launches the virus:

In the “Object” line (it’s quite long) you can find the path to the virus, most often it’s something like 118920.exe in the Recycle folder on the flash drive itself. in this case The double run line looked like this:

%windir%\system32\cmd.exe /c "start %cd%RECYCLER\6dc09d8d.exe &&%windir%\explorer.exe %cd%support

Here is the same path: RECYCLER\6dc09d8d.exe - a folder on a flash drive and a virus in it.

We delete it along with the folder - now clicking on the shortcut is not dangerous (if you did not manage to launch it before).

Step 3. Restore the previous appearance of folders.

Our folders are transparent - this means that the virus loader has marked them as system and hidden. You can’t simply disable these attributes, so you need to use the attributes reset via the command line.

There are 2 ways to do this:

Open “Start” - Item “Run” - Enter the CMD command - press ENTER.

A black window will open command line you need to enter the following commands:

cd /d f:\ press ENTER, where f:\ is the letter of our flash drive (may differ from the example) attrib -s -h /d /s press ENTER - this command will reset the attributes and the folders will become visible.

The second option is to create text file at the root of the flash drive. Write a command attrib -s -h /d /s into it, rename the file to 1.bat, place it in the root of the flash drive and run it. After launching it, a black window will appear, do not close it, but wait and everything will not be restored. After this, you can remove the folder shortcuts.

If you are unable to create such a file, you can download: Bat file for changing attributes (.zip). If there are a lot of files, the command may take time to complete.

After this, you can return to the first step and restore old look folders, that is, hide system hidden files.

Another option for the .bat file:

:lable cls set /p disk_flash="Vvesti buky flash drive: " cd /D %disk_flash%: if %errorlevel%==1 goto label cls cd /D %disk_flash%: del *.lnk /q /f attrib -s -h -r autorun.* del autorun.* /F attrib -h -r -s -a /D /S rd RECYCLER /q /s explorer.exe %disk_flash%:

Read, how to remove a virus that converts files and folders into shortcuts. How to recover data that was lost as a result of such a virus. Your files and folders are on USB flash drive Or did the memory card become shortcuts? Does a USB flash drive or memory card appear as a shortcut after connecting to a computer? Are you looking for how to recover data and remove a virus that converts files and folders into shortcuts? Are you using an antivirus, but your computer is still infected? Unfortunately, not all antiviruses can protect you from such infections.

Types of shortcut viruses

Today, there are two most common types of viruses that create shortcuts: the first create shortcuts instead of files and folders on a flash drive or memory card, others create shortcuts to removable drives instead of the flash drives themselves, external USB disks and memory cards.

Names of the most common viruses:

• Bundpil.Shortcu;
• Mal/Bundpil-LNK;
• Ramnit.CPL;
• Serviks.Shortcut;
• Troj/Agent-NXIMal/FakeAV-BW;
• Trojan.Generic.7206697 (B);
• Trojan.VBS.TTE(B);
• Trojan.VBS.TTE;
• VBS.Agent-35;
• VBS.Serviks;
• VBS/Autorun.EY worm;
• VBS/Autorun.worm.k virus;
• VBS/Canteix.AK;
• VBS/Worm.BH;
• W32.Exploit.CVE-2010_2568-1;
• W32.Trojan.Starter-2;
• W32/Sality.AB.2;
• Win32/Ramnit.A virus;
• Worm:VBS/Cantix.A;

A virus that converts files and folders into shortcuts

This virus duplicates your files and folders, then hides and replaces them. The virus is a combination of a Trojan and a worm. The danger is that you run a virus every time you want to open your file or folder. Once launched, the virus spreads itself, infecting everything large quantity files and often installs additional malware that can steal password data and credit cards, saved on your computer.

A virus that converts flash drives and memory cards into shortcuts

This is a purebred Trojan virus, which hides any removable devices connected to the computer and replaces them with shortcuts to those devices. Each time you click on the shortcut, you again launch the virus, which searches your computer for financial information and sends it to the scammers who created the virus.

What to do if infected

Unfortunately, not all antiviruses can detect danger in time and protect you from infection. That's why best protection will not use automatic start removable devices and do not click on shortcuts to files, folders or drives. Be careful not to click on shortcuts that you did not create yourself. Instead of double-clicking to open the disk, click on it right click mice and select Expand in Explorer.

Recovering data deleted by a virus

To reliably recover data deleted by this type of virus, use Hetman Partition Recovery. Since the program uses low-level disk functions, it will bypass virus blocking and read all your files.

Download and install the program, then analyze the infected flash drive or memory card. Perform data recovery before cleaning the media from the virus. The most reliable treatment option is to clean the flash drive using the DiskPart command; this will delete all information on it.

Removing a virus from a memory card or USB flash drive

After recovering data from a flash drive, you can completely clear it using the DiskPart utility. Deleting all files and formatting the device may leave a virus that will hide in boot sector, partition table, or unallocated area of ​​the disk. Watch the video to see how to properly clean a flash drive.

Removing a virus from a flash drive using the command line

This method does not guarantee to clean the flash drive from all types of viruses, but it can remove a virus that creates shortcuts instead of files. You won't need to download and install third party utilities, removal is done using the built-in Windows version tool.

Removing a virus from a computer

The simplest and most reliable way to clean your computer from a virus is to completely reinstalling Windows with deleting the system partition.

But if you are experienced user, you can try the following method:

The ingenuity of virus software developers knows no bounds, and no one will be surprised by ordinary Trojans that steal data, or advertising banners, to close which the scammers require you to send them paid SMS. The original is a virus that penetrates external storage(flash drive or HDD) and turns all folders into shortcuts, or rather, the user thinks so.

In fact, the virus application hides real folders with data and replaces them with shortcuts with the same name. By clicking on the virus shortcuts, malicious programs are installed from the flash drive onto the computer. If the computer user does not have antivirus installed software, it risks seriously infecting your computer malware which may subsequently lead to the loss of personal data, important files and other problems.

Important: If the folders on the flash drive have been replaced with shortcuts, do not click on them, even if they have names like “How to solve a problem”, “Read me”, “ReadMe” and others. In a similar way, attackers force the user to activate their virus software.

What to do if folders on a flash drive become shortcuts

As mentioned above, the main thing is similar situation do not fall for the tricks of the virus and do not click on the files it creates. To get rid of virus shortcuts and not harm your files, you need to do the following:

On Windows 8, 10 and XP: {System hard drive):\Users\(Username)\AppData\Roaming On Windows 7:(System Hard Drive):\Documents and Settings\(Username)\Local Settings\Application Data\

Please note: To see AppData folder, as well as some others, you will need to initially enable the display in the “Control Panel” hidden files and folders.

For this:

Having gotten rid of the virus, you can move on to eliminating the problems that arose as a result of its actions.

How to make hidden folders visible after a virus attack

The malicious application, as noted above, hides folders and creates shortcuts instead. After the virus is removed, the folders remain hidden. Usually they can be made visible by right-clicking on them, selecting “Properties” and on the “General” tab unchecking the “Hidden” option.

However, the problem of this virus, which turns folders on a flash drive into shortcuts, is that the ability to uncheck the hidden option disappears, since the attribute becomes inactive.

in order to change this property and make the folder visible again, you need to create a “Notepad” document in the root of the flash drive. When it is created, open it and write the command in it:

Attrib -s -h -r -a /s /d

Next, select “File” - “Save As”. Give the file any name, but write at the end .bat– an extension for it. After the notepad in the specified extension is saved in the root folder of the flash drive, you need to right-click on it and run it as administrator. After this, a command will be executed, as a result of which the user will have the opportunity to make visible again hidden folders.