The ingenuity of virus software developers knows no bounds, and no one is surprised by the usual Trojans that steal data, or advertising banners, to close which scammers require you to send them paid SMS. The original is a virus that penetrates external drive(flash drive or HDD) and turns all folders into shortcuts, or rather, the user thinks so.
In fact, the virus application hides real data folders and replaces them with shortcuts with the same name. By clicking on virus shortcuts, malicious programs are installed on the computer from the flash drive. If the computer user does not have an anti-virus installed software, he runs the risk of seriously infecting the computer malware, which can subsequently lead to the loss of personal data, important files, and other problems.
Important: If the folders on the flash drive have been replaced by shortcuts, do not click on them, even if they have names like "How to solve a problem", "Read me", "ReadMe" and others. In a similar way, attackers force the user to activate their virus software.
What to do if folders on a flash drive have become shortcuts
As mentioned above, the main thing in such a situation is not to fall for the tricks of the virus and not to press on the files it has created. To get rid of virus shortcuts and not harm your files, you need to do the following:
On Windows 8, 10 and XP:(System HDD):\Users\(Username)\AppData\Roaming On Windows 7:(System HDD):\ Documents and Settings\(Username)\ Local Settings\Application Data\ Please note: To see AppData folder, as well as some others, you will need to initially enable the display of hidden files and folders in the Control Panel.
For this:
Having got rid of the virus, you can proceed to fix the problems that have arisen as a result of its actions.
How to make hidden folders visible after virus actions
The malicious application, as noted above, hides folders and creates shortcuts instead. After the virus is removed, the folders remain hidden. You can usually make them visible by clicking on them. right click mouse, select "Properties" and on the "General" tab, uncheck the "Hidden" item.
However, the problem this virus, which turns folders on a flash drive into shortcuts, in that it is no longer possible to uncheck the hidden option, since the attribute becomes inactive.
To change this property and make the folder visible again, you need to create a Notepad document in the root of the flash drive. When it is created, open it and write the command in it:
Attrib -s -h -r -a /s /d
Then select "File" - "Save As". Give the file any name, but at the end write .bat is an extension for it. After the notepad in the specified extension is saved in the root folder of the flash drive, you need to right-click on it and run it as administrator. After that, a command will be executed, as a result of which the user will have the opportunity to make visible again hidden folders.
If suddenly the folders have become shortcuts on the flash drive, do not click on them, but restore them as follows.
Making files invisible
Click Start - Control Panel - Appearance and Personalization - Folder Options - Show hidden files and folders and in the window that opens, check the box (show hidden files, folders and drives).
Now folders and shortcuts will be visible instead of files on the flash drive, but the folders will be transparent.
We remove the virus
Shortcuts run the same file. Right-click on any shortcut and click properties. In the properties, click on the label tab and look at the object item.
The item object is quite long, but it is easy to find the path to the virus in it, most often it is something like 456325.exe in the Recycle folder on the flash drive itself. We delete it along with the folder and now clicking on the shortcut is not dangerous.
We bring the flash drive to its previous form
We delete all shortcuts of our folders as they are not necessary. Our folders are transparent - this means that the virus loader marked them as system and hidden. You can't disable these attributes just like that, so you need to use the reset attributes via the command line. This can be achieved in two ways:
Method 1. Open Start - Item Run - Enter cmd command- press ENTER. opens black window command line in it you need to enter the following commands:
cd /d e:\ press ENTER, where e:\ is the letter of our flash drive (may differ from the example).
attrib -s -h /d /s press ENTER - this command will reset the attributes and the folders will become visible.
Method 2. Create text file on a flash drive. Write the command attrib -s -h /d /s into it, rename the file to 1.bat and run it. If there are a lot of files, then it may take time to execute the command, sometimes up to 10 minutes!
After that, you can return to the first step and restore previous view folders, that is, hide system hidden files. Now the shortcuts that appeared on the flash drive instead of folders will disappear and the folders will return to their previous form.
Viruses do not sleep, their developers come up with more and more new ways not only to infect flash drives, and just computers, but also new methods of distribution. Today we will talk about the situation when folders with the name of the flash drive itself are created on a flash drive - you must understand that this is a virus.
So, the virus creates a shortcut on the flash drive, which allegedly leads to rundll32.exe(even though there is no such folder). If you double-click on the shortcut, then there will be files from the flash drive itself. In general, at first it may seem that this is not a problem, now we will take the files from there and remove the shortcut, but not everything is so simple.
The most interesting thing is that the files do not disappear and you can continue to work with the flash drive, but there is only one thing - when you connect the flash drive to the computer, the script writes itself to the computer in order to infect other flash drives that will ever be connected to that computer .
The virus is also unique in that it spreads only with the help of flash drives.
So, now let's move on to the most important thing - how to fix this situation.
Treatment of a virus on a flash drive that creates a shortcut
We connect such a USB flash drive to the computer and run the command line, for this we press Win + R. A black window will appear, that is, the console. We write the following in it:
cd /d F: (for example, my flash drive is the letter F, you may have a different one, so be careful);
attrib -s -h -a -r /s /d *.* (*.* is a mask, it means that we will “treat” all files on the flash drive);
After that, we can open the flash drive and see that all the files are in place.
After that, you need to delete all files, and leave only autorun.inf.
Now we need to open the Process Explorer program, if you do not have it, then download it.
Open Process Explorer, go to the menu File(above) and select there Show Details for All Processes so that all processes are visible.
We hold down the combination Ctrl + L, after which a window will appear at the bottom of the program, where all the processes will be. Now we need to find the file autorun.inf, as a rule, it is in a branch svchost.exe.
Now right-click on the found process and select close handle ( close handle) - this usually goes without problems. And after that we delete the file autofun.inf from a flash drive.
After that, we need to get into the temporary folder Temp, let which is: C:\users\%username%\AppData\Local\Temp(you can copy and paste into the address bar of the explorer). In this folder, you need to find an unusual file with the extension .pif, we can either manually search for it or use the search, but it’s better to delete everything from this folder, it won’t be worse for the computer, but it’s better - most likely yes.
If you did everything correctly, then you will no longer have this virus either on your computer or on a flash drive.
It is better to check your computer for viruses after all the steps, if you do not have it installed, then I recommend using
A flash drive is a removable media that helps many users keep everything required files with you and use them at the right time. However, there are times when the user finds that the files on the flash drive have become shortcuts and cannot be opened. What to do in this case and how to fix the problem.
Reasons for the appearance of shortcuts to files and folders on a USB flash drive
The reason that folders and files on a flash drive have become shortcuts is a virus. Once on a removable device by transferring or copying files, it infects the contents and prescribes its commands. Therefore, in no case should you try to run all the files in turn, with the hope of opening them. The virus prescribes its own command in each, which can be directed to defeat operating system. Also, do not delete all content or format the device. Remember, all files have become shortcuts, however, they are not damaged and have not disappeared anywhere.
How to fix the situation when all the files on the flash drive have become shortcuts?
Users often ask themselves the question: what to do if all the folders on the flash drive have become shortcuts and do not open?
There are a few simple steps to solve this problem.
First you need to enable the display of hidden folders and files. For Windows systems XP, the following address will do: Start, My Computer, Tools, Folder Options.
The settings window will open. Go to the "View" tab and check "Show hidden folders and files".
For Windows 7, we perform the following steps: "Start", "Control Panel", "Appearance and Personalization".
Then click "Folder Options" and go to the "View" tab. Here we put an identical mark.
Go to the "Labels" tab and check the "Object" field. This will be the address of the folder from which the malware is launched.
The name that is highlighted on the screen is the name of the folder that is located on the drive and is open to the user. It needs to be removed. It is also worth looking at the path addresses of all shortcuts and destroying viruses.
For accurate and complete cleaning worth checking for exe. file on a PC at the following addresses:
- For Windows XP - drive C, folder "Documents and Settings", "Username", "Local Settings", "Application Data".
- For Windows 7 - C drive, "User" folder, after "Username", "Appdata" and "roamling".
If there is an exe file in these folders, this is a virus and must be removed.
After the folders with malicious objects have been destroyed, it is necessary to return the files to their original form. There are several ways to do this.
Method one
Click "Start", "Run" (or Win + R). Enter the "cmd" command.
The line will start. Type "cd / d f:\" and press "Enter". The letter "f" means the name of the flash drive.
After that, we enter the command to reset the attributes of the folder "attrib -s -h / d / s". We press "Enter".
Method two
Open the flash drive, right-click and click "Create", "Text Document".
Enter source: "attrib -s -h/d/s".
We save the file. After we rename its extension to bat. We start and all attributes are reset.
Now, all files and folders that have become shortcuts will return to their original appearance and all contents will be intact.
Modern antiviruses have already learned how to block autorun.inf, which launches a virus when a USB flash drive is opened.
A new type of viruses of the same family has been walking around the network and from flash drive to flash drive for a long time, simply - regular Trojans. Infection with them can be immediately detected with the naked eye without any antiviruses, the main symptom is all folders on the flash drive turned into shortcuts.
If there are very important files on the flash drive, the first thing you will do is open all the folders (shortcuts) one by one to make sure the files are there - this is not worth it at all!
The problem is that these shortcuts contain two commands each, the first is to launch and install a virus on a PC, the second is to open your precious folder.
We will clean the flash drive from such viruses step by step.
Step 1. Show hidden files and folders.
If you have Windows XP, then we go through the path: “Start-My Computer-Menu Tools-Folder Options-Tab View”:
On the "View" tab, we find two parameters and execute:
- Hide protected system files(recommended) - uncheck
- Show hidden files and folders - set the switch.
If you have Windows 7, you need to follow a slightly different path: "Start - Control Panel - Appearance and Personalization - Folder Options - View Tab". 
You need the same options and you need to enable them in the same way. Now your folders on the flash drive will be visible, but they will be transparent.
Step 2. Cleaning the flash drive from viruses.
An infected flash drive looks like the picture below: 
In order not to delete all files from the flash drive, you can see what any of the shortcuts launches (usually they launch the same file on the same flash drive). To do this, you need to look at the properties of the shortcut, there you will find a double launch - the first one opens your folder, and the second one launches the virus: 
We are interested in the string "Object". It is quite long, but it is easy to find the path to the virus in it, most often it is something like 118920.exe in the Recycle folder on the flash drive itself. In my case, the double launch line looked like this:
%windir%\system32\cmd.exe /c "start %cd%RECYCLER\6dc09d8d.exe &&%windir%\explorer.exe %cd%support
Here is the same path: RECYCLER\6dc09d8d.exe- a folder on a flash drive and a virus in it.
We delete it along with the folder - now clicking on the shortcut is not dangerous ( if you haven't run it yet).
Step 3. Restoring the previous look of folders.
1. Delete all the labels of our folders - they are not needed.
2. Our folders are transparent - this means that the virus loader marked them as system and hidden. You can't disable these attributes just like that, so you need to use the reset attributes via the command line.
There are 2 ways to do this:
Open "Start" - "Run" - Type CMD - press ENTER. A black command prompt window will open, in which you need to enter the following commands:
- cd /d f:\ press ENTER, where f:\ is the letter of our flash drive (may differ from the example)
- attrib -s -h /d /s press ENTER - this command will reset the attributes and the folders will become visible.
1. Create a text file on a flash drive.
2. Record a team attrib -s -h /d /s into it, rename the file to 1.bat and run it.
3. In the case when you are unable to create such a file, you can download mine: .
If there are a lot of files, then it may take time to execute the command, sometimes up to 10 minutes!
4. After that, you can return to the first step and restore the previous view of the folders, that is, hide the system hidden files.
How to check if your PC is a carrier of a virus?
If you have a suspicion that it is your PC that spreads this virus across flash drives, you can view the list of processes in the task manager. To do this, press CTRL + ALT + DEL and look for a process with a name similar to FS..USB ..., instead of dots - any letters or numbers.
Source this process neither AviraAntivir, nor DrWeb CureIT, nor Kaspersky Removal Tool is removed.
I personally removed it with the F-Secure trial version, but it hides in the form of a driver and you can find it using the utility autoruns.
If you remove a virus from a flash drive, and the folders become shortcuts again?
Let me tell you, I have never been in this situation. How to treat exactly - I do not know. I see three ways out of the situation:
- we demolish Windows (1.5-2 hours, the fastest way);
- install F-Security, Kaspersky, Dr.Web ( trial versions) take turns and study the computer " full checks»until we find a virus (usually 3-4 hours, depending on the power of the PC and the number of files);
- burn DrWeb LiveCD to a disk or flash drive, boot from it and study the computer.
- F-Secure Online Scanner (will ask you to run the Java module, you must agree)
You can download trial versions of these antiviruses for 1 month, update their databases and check your PC with them.
It seems to be everything, please contact me - I will always answer, sometimes with a delay.
“I can add that there are also such viruses as Sality (Sector XX - where XX numbers like 05, 15, 11, 12 are modifications, who creates them is not clear) spoils executable .exe files... with such viruses, he invented his own way of dealing with the use of the same Dr.Web CureIt! having a WinXPE system on hand recorded on a 700 meter CD-R ... loading the system from a disk and using not hard memory, but operational memory.
Works great. The disk inserted the boot from the disk, turned it on, put the USB flash drive with the pre-recorded “FRESH” CureIt! what is most interesting during this process, as with the Life CD from the Web, the viruses “sleep”, i.e. the system is not loaded, and somehow it is more convenient with the operational one.
