January 9, 2012 By 11 Comments

All Folders Became Shortcut! How to Fix Them?

shortcut-01

My USB thumb drive got infected by a trojan virus. All folders in the thumb drive had become shortcuts!

From the properties, the shortcut folder is pointing to 0x29ACAAD1.exe file. Kaspersky detects it as Trojan.Win32.VBKrypt.cvcu, and 35 out of 42 antivirus companies confirmed that it is a trojan virus – VirusTotal result.

Warning: Don’t double click the shortcut or you will execute the trojan virus.

Luckily, you don’t need a data recovery tool to fix this problem. The only thing that you need is just the command prompt.

Here I’ll show you how:

  1. Go to Start > Run.
  2. Type, “cmd” and click Ok.

  3. Now type this command, and press Enter:

    attrib -h -r -s /s /d f:\*.*

    Note: Replace f: with your USB drive letter.

  4. Done.

You will see two folders in the USB thumb drive. One is the shortcut, and the other one is the original folder as shown below.

shortcut-02

Now copy the orginal folders to a safe place, and format your USB thumb drive. This to ensure that your thumb drive is completely free from the trojan virus, and don’t forget to scan your computer with antivirus too.

That’s all. Hope this help!

Btw, if your files and folders are suddenly missing/hidden in USB thumb drive, follow this trick to unhide them.

Filed Under: How To Tagged With: , , , , ,

Comments

  1. harris says:
    January 22, 2012 at 10:24 pm

    hi i got this problem but when i execute this in the cmd.exe

    attrib -h -r -s /s /d f:\*.*

    it says access denied

    Reply
  2. lu says:
    February 8, 2012 at 4:33 am

    nice job my frenz!!

    Reply
  3. friendsforever says:
    February 27, 2012 at 4:45 am

    Thousands of html files infected with HTML/Drop.Agent.AB virus.
    Kindly requesting a script file for cleaning the infected files. Script should accept Drive letter as argument. Need a Windows shell or VB script to run on Win-(XP,Vista,7), to recursively search through a entire drive/partition for html files, CLEAN files by Deleting everything after “” i.e. “closing HTML tag”, virus code starts from this point and create a log file for listing of edited files.

    NO NEW FILES TO BE CREATED (strict rule).

    Reply
  4. jmeter says:
    February 28, 2012 at 5:42 pm

    Nice job! helpful, thanks.

    Reply
  5. Paul Azar says:
    April 11, 2012 at 8:08 pm

    it says :
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\DE\animation.exe
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\EN\animation.exe
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\ES\animation.exe
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\FR\animation.exe
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\ISSetupPrerequisites\{726F97A8-63B9-4A58-ACFB-B8A56B383740}\msxml6_x86.msi

    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\ISSetupPrerequisites\{726F97A8-63B9-4A58-ACFB-B8A56B383740}
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\IT\animation.exe
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\KR\animation.exe
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\SCH\animation.exe
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\TCH\animation.exe
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\Cedar.dbd
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\Cedar.txt
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\DE
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\demo32.exe
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\EN
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\ES
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\FR
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\gdiplus.dll
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\ISSetupPrerequisites
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\IT
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\KR
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\SCH
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\Seagate_Manager.exe
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\start.exe
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI\TCH
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RT
    HJRQ6\S-1-5-21-2009832974-670866683-1287559378-1005
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3471445141-596948144-816103079-1000\$RJ
    Q1DPI
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-2177543669-2062368359-1506785694-1000
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-3348415276-3530887630-3728895030-1000
    Access denied – G:\$RECYCLE.BIN\S-1-5-21-579135528-1097029123-891382625-1000
    PLZ HELP ME !

    Reply
  6. Kaspar says:
    April 21, 2012 at 4:14 pm

    It worked for me. Thanks!

    Reply
  7. Jason says:
    April 24, 2012 at 11:58 am

    how do you get rid of this virus on your pc. windows 7

    Reply
  8. iezza says:
    April 30, 2012 at 6:01 pm

    yeah….thx so much..very helpful!!

    Reply
  9. psyciq90 says:
    May 11, 2012 at 8:13 pm

    THANX BRO !! YOU SAVE MY LIFE !!!

    Reply
  10. charlie:D says:
    May 15, 2012 at 9:56 pm

    yessssssssssss!it really worked!huhu!you save my lifeeeeeeeeeeeeeeee!love you!thank you so muchhhhhhhhhhhhhhhh!

    Reply

Speak Your Mind

*