Troubleshooting All of my external hard disk files become .lnk after getting some autorun virus

datenshi07

datenshi07

New Member
Okay. So I brought my external hard disk (1TB) for my school files. I had to get my files from there, so I plugged 'em to the school/lab computer. By that time, I didn't noticed any problem until I got home and plugged my external hard disk to my PC.

All of my files are compressed into one single .lnk file with the name of my hard disk. I couldn't open it either. I already scanned with Avira and USB Disk Security, but they only found the autorun virus. After scanning, I checked my infected hard disk with Winrar. I only found; System Volume Information, desktop.ini, Thumbs.db, ~$WKM.USBDrv, TAPIOCA(932GB).lnk(tapioca is the name of my hard disk).

As far as I know, .lnk is a shortcut file, so I thought that there's a original file location. So I right clicked the .lnk file and it directed me to a single file which is named as "rundll32.exe" inside the folder system32 in my local disk.

Is there a way to recover my files without formatting my external disk?(My friend got one also and she formatted her flash drive. And I don't want to do that.) All of my important files are there, and I want to get all of them safe. So, please PLEASE help me. I'm begging you guys, I don't wanna lose those precious and important files. I don't have any back-ups in my PC.

BTW, my PC is Windows7 32-bit and school PC is Windows7 64-bit. And also, my 4GB flash disk is infected with same virus from same PC
[attachment=3587]

Thanks in advance!
 

Attachments

  • OTL.Txt
    OTL.Txt
    78.1 KB · Views: 1,074
  • Extras.Txt
    Extras.Txt
    84.1 KB · Views: 1,039
  • OH GOD WHY.png
    OH GOD WHY.png
    387.3 KB · Views: 2,785
Sort by date Sort by votes
Hi,

Goto Start > Computer > Organize > Folder and search option > View > Under Hidden file and folder, select show hidden files, folders and drives > Click Ok.

Then go back to the Computer interface and access the drives there, not through winrar. See if you can see your files.
 
Upvote 0
The free space hasn't changed at all. If it changed, I guess it's just a little. (I can't remember the exact amount of free space I had before I got the virus.) Avira detected autorun.inf
 
Upvote 0
Click start > run > type CMD in the box and press Enter. In the Command Prompt, type:

attrib –h –r –s /s /d f:*.*

Then,

attrib -h -r -s /s /d g:\*.*

NOTE the spaces in between the dashes and the hyphens.
 
Upvote 0
Some files and folders appeared after I entered the commands in CMD. And from these files and folders, I found my files! Thank you so much! I couldn't express my gratitude through this, but thank you so much! BTW, what should I do with these extra folders? (Except for one folder with my files inside.) Can I just delete them like normal files?[attachment=3601]
 

Attachments

  • thanks.png
    thanks.png
    123.7 KB · Views: 3,111
Upvote 0
Good to hear :D

And it depends which file/folder you want to delete. Since we enabled all the hidden files on the drive, some files may be related to the HD
 
Upvote 0
Fiery said:
You're very welcome :)
Click to expand...
hi fiery

i have usb in drive in drivr F:
so i used code


F:
attrib -h -r- s /s /d *.*


and i opened usb i some how deleted micro.vbs


wen i again try above code in cmd it pops out


access denied ,

now what i must do to recover micro.vbs and
remove shortcut virus

plse help asap


tahnk you, in advance mate .. :)
 
Upvote 0

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top