Troubleshoot All of my external hard disk files become .lnk after getting some autorun virus

[datenshi07]

Okay. So I brought my external hard disk (1TB) for my school files. I had to get my files from there, so I plugged 'em to the school/lab computer. By that time, I didn't noticed any problem until I got home and plugged my external hard disk to my PC.

All of my files are compressed into one single .lnk file with the name of my hard disk. I couldn't open it either. I already scanned with Avira and USB Disk Security, but they only found the autorun virus. After scanning, I checked my infected hard disk with Winrar. I only found; System Volume Information, desktop.ini, Thumbs.db, ~$WKM.USBDrv, TAPIOCA(932GB).lnk(tapioca is the name of my hard disk).

As far as I know, .lnk is a shortcut file, so I thought that there's a original file location. So I right clicked the .lnk file and it directed me to a single file which is named as "rundll32.exe" inside the folder system32 in my local disk.

Is there a way to recover my files without formatting my external disk?(My friend got one also and she formatted her flash drive. And I don't want to do that.) All of my important files are there, and I want to get all of them safe. So, please PLEASE help me. I'm begging you guys, I don't wanna lose those precious and important files. I don't have any back-ups in my PC.

BTW, my PC is Windows7 32-bit and school PC is Windows7 64-bit. And also, my 4GB flash disk is infected with same virus from same PC
[attachment=3587]

Thanks in advance!

 

[Fiery]

Hi,

Goto Start > Computer > Organize > Folder and search option > View > Under Hidden file and folder, select show hidden files, folders and drives > Click Ok.

Then go back to the Computer interface and access the drives there, not through winrar. See if you can see your files.

 

[datenshi07]

I clicked the show option but still can't see my files.
[attachment=3589]

 

[Fiery]

Has the amount of free space changed after the infection? Do you remember what the virus name was that avira detected?

 

[datenshi07]

The free space hasn't changed at all. If it changed, I guess it's just a little. (I can't remember the exact amount of free space I had before I got the virus.) Avira detected autorun.inf

 

[Fiery]

Click start > run > type CMD in the box and press Enter. In the Command Prompt, type:

attrib –h –r –s /s /d f:*.*

Then,

attrib -h -r -s /s /d g:\*.*

NOTE the spaces in between the dashes and the hyphens.

 

[datenshi07]

Some files and folders appeared after I entered the commands in CMD. And from these files and folders, I found my files! Thank you so much! I couldn't express my gratitude through this, but thank you so much! BTW, what should I do with these extra folders? (Except for one folder with my files inside.) Can I just delete them like normal files?[attachment=3601]

 

[Fiery]

Good to hear

And it depends which file/folder you want to delete. Since we enabled all the hidden files on the drive, some files may be related to the HD

 

[datenshi07]

M'kay!! Thank you again! (^ω^)

 

[Fiery]

You're very welcome

 

[sanket saurav]

i am facing same problem on my mac..
plz tell me the solution for mac. thanks

 

[Mateotis]

i am facing same problem on my mac..
plz tell me the solution for mac. thanks

Please open a new topic here. One of our experts can surely help you.

 

[inventordeepan]

You're very welcome

hi i

You're very welcome

have same issue my drive is F: plse provide solution

 

[inventordeepan]

You're very welcome

hi fiery

i have usb in drive in drivr F:
so i used code


F:
attrib -h -r- s /s /d *.*


and i opened usb i some how deleted micro.vbs


wen i again try above code in cmd it pops out


access denied ,

now what i must do to recover micro.vbs and
remove shortcut virus

plse help asap


tahnk you, in advance mate ..