Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

all my folders are changing to shortcuts and they are becoming hidden


  • Please log in to reply
1 reply to this topic

#1 elaheh

elaheh

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:04:39 AM

Posted 03 November 2011 - 03:44 AM

Hello,

I am running windows 7 Starter with the free version of Microsoft Security Essentials fully updated and ive had this virus for about a week and what happens is it changes all my folders on any usb plugged into my computer to shortcuts.

Originally, I understood last week that there is a virus on my compuer, my flash and also my voice recorder. and it changed all my folders on my computer to shortcuts, i couldnt access regedit or any applications and when I clicked on a shortcut folder a dos prompt would come up and dissapear. So I formatted my computer and all my external HDD's and it fixed my computer anyway.

Now, every time i plug in a usb stick or external hard drive it changes the folders. I did some research and managed to get the folders back and found a suspicious folder on every usb stick called RECYCLER inside it is an .exe called 686c1039.exe and a desktop.inf I have tried, AVG anti virus, Malwarebytes, spyware search and destroy and none could detect it. I also used autorun.inf eater which found a bad autorun.inf on all the external drives, which It deleted. However, when it deleted it and i took out the HDD then plugged it back in the RECYCLER folder and the autorun.inf come back. I should also not a file which I beleive is an .exe (with a recycle bin icon) appears occasionally.

I took one of my usbs to uni to do some work and when my freind plugged in their external HDD with my infected USB the virus went onto his external HDD. So what we did was take the now infected HDD put it on a new computer, took all his files off of it then unplugged the newly infected drive and put in a new drive and put all the files on that. Which worked. he has used it for a day with no issue

I read a tutorial to find some bad registry entries which may be the problem but could never find exactally what they asked for on another forum. From memory it was in the HKEY software folder in windows then explorer and they had me look for a hide or super hide entry which wassnt there.

For the last day I ended up formatting all my usbs and externals and my computer again. Which I thought worked because the RECYCLER folder or the autorun.inf never came back no matter how many times I unplugged the drive and plugged it back in. Great I thought, then I decided to try another laptop with vista and outdated mcaffe antivirus. Soon as I plugged in the external its back. However, when I plugged it back in my computer and deleted the autorun.inf and RECYCLER folder and repaired the folders, formatted the external HDD then took it out and plugged it back in its fine on my computer. One way I know this is when I suspected I had the virus it wouldnt let me eject the HDD, saying it was used by another process. That has stopped now

If anyone can help that would be wonderful as im trying to fix my freinds external HDD.

I should also add after formatting all the drives and my computer again the autorun.inf never comes back nor the RECYCLER.exe it just changes the folders to shortcuts and makes the real folders hidden system folders.

I hope I have put enough information here and Im happy to provide more if need be.

Edited by hamluis, 03 November 2011 - 08:01 AM.
Moved from Win 7 to Am I Infected.


BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,716 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:09 PM

Posted 03 November 2011 - 02:13 PM

With the information you have provided I believe you will need help from the malware removal team.
Please make sure that you read the information about getting started first.
Then start a new thread HERE and include or required logs.
Including a link to this thread will be helpful.

Good luck and be patient. Help is on the way!

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users