I had a client drop off their flashdrive with me this morning, saying that the files they had had somehow disappeared from their USB stick. I had a feeling I’d see virus warnings pop-up when plugging it into my machine and sure enough, my trusty Avast AV picked up the Autorun that tries to infect PC’s on inserting an infected flash drive.
Anyway I cleaned the drive of a bunch of strangely named .exe files and then started looking for the ‘lost’ files. I noticed that the folders the client had talked about had now become shortcuts instead of folders. Took a look at where the shortcut was pointing and each was pointing to one of the infected executable files.
Did a quick search and eventually found a simple fix.
The virus hides the original folders and in their place puts shortcuts which if you double-click to open, runs the virus. So just had to un-hide the files and folders …
In Windows XP – Click on ‘Start’ > ‘Run’ > type ‘cmd’ and then click on OK.
In Windows 7 – Click ‘Start’ then type ‘cmd’ in the ‘Search’ and hit enter. [if you have problems browse to ‘Command Prompt’, right-click and ‘Run as Administrator’]
Type the following to change the file attributes
attrib -h -r -s /s /d x:\*.*
Note : Replace the letter x with your flash drive letter. (There are spaces between the -h, -r, -s as well as between the /s, /d and x:\*.*)