It must be that today most often flash drives are affected, being the most common devices. Any viruses, rootkits, and trojans primarily attack this type of media. Often, after a drive is infected, a user notices that folders and files have become shortcuts on a USB flash drive. In this case, it is not possible to extract or read information from a directory or file. Of course, no one will forbid to format the drive and get rid of the problem in one fell swoop, but if the file system stores important data, this option is impossible. Why did all the folders on the flash drive become shortcuts and how to deal with this problem? This will be described in the article.
About viruses and users
An ordinary user, faced with a problem, acts like this: just clicks on each shortcut in an attempt to access at least one directory. The second scenario is formatting, which does not solve the problem, and if it solves (in the absence of important data), then not for long.
Remember, the information from the flash drive does not disappear. All folders became shortcuts, and the folders themselves are hidden, but not deleted. The data continues to remain in place, but the virus has masked it, trying to pass links to the launch of malicious code as the source content. It follows that you should not click on these links, even if they open the necessary directory. Typically, a malicious program creates shortcuts that link to a special service file, where two commands are embedded. The first loads the virus into memory and copies it to the hard drive of the computer, the second - opens the directory necessary for the user.
But do not think that if the files and folders on the flash drive turned into a shortcut, but did not open, the virus did not penetrate the local machine. Most likely, the malware has already moved to the user's computer. This possibility is excluded only if autorun from removable media is disabled in the operating system or an antivirus with the latest virus databases is installed.
Virus Removal: Manual Methods
Before restoring the original type of directories, you must remove the malware. You can do this manually or in automatic mode. In the first case, you need to find out where the virus program file is located.
Right-click on the shortcut and select the "Properties" line. Pay attention to the area called "Object". Here is the full path to the program that launches the virus. Just because of him, the files on the flash drive became shortcuts. In almost all cases, each label will refer to the same data area on the storage medium. It should be removed. If the malware is located in a directory that it created itself (that is, there was no flash drive before this directory), you can delete all its contents.
In addition to the flash drive, check also the directory roots:
- C: \ Users \ UserName \ AppData \ Roaming.
- C: \ Documents and Setting \ UserName \ Local Settings \ Applications Data.
If you find any executable file (with exe extension) in them, most likely your computer is infected and you need to use an antivirus program.
Specialized virus removal
If the files on the USB flash drive have become shortcuts, then in order to completely get rid of malware, and at the same time to be safe, you need to check not only the USB flash drive, but the entire computer with an anti-virus scanner . At the same time, malware often injects its code into an antivirus already installed on the machine, therefore it is best to use a special bootable drive that can be easily created. Moreover, the developers of anti-virus screens themselves contribute to the development of this segment of applications.
Create Bootable CD
Even a novice user will cope with this task. The algorithm of actions is as follows:
- Download Dr.Web LiveDisk from the official website of the developer.
- Download the UltraISO program and install. At the same time, during the installation of the application, its functions will be integrated into the explorer, which will make the burning process the easiest.
- Double-click on the LiveDisk image file. The UltraISO window opens immediately. The user will only have to click on the "Record" button, after inserting a blank disc into the DVD-ROM.
- After a few minutes, the boot drive will be ready.
Creating a bootable flash drive
There are times when files on a USB flash drive have become shortcuts, but there isn’t any blank disc available for burning, or the CD drive is not installed at all on the computer. Then you can create a bootable USB flash drive. Moreover, this procedure is simpler and faster than burning a CD.
- Download the Dr.Web LiveDisk distribution kit for USB drives from the official website.
- Run "drwebliveusb.exe" (it is advisable to perform this operation as an administrator).
- Remember to insert the flash drive into the USB port.
- In the drop-down menu, select the device on which LiveDisk will be recorded.
- Check the box next to "Format" and click on the button "Create LiveUsb"
- After completing all the processes, click "Exit".
Preparing for Download
After creating a bootable USB flash drive or disk, you must configure the BIOS. To enter the configuration utility, you will have to press the "DEL" key (less often - "F12") on the very initial computer boot screen. Follow the messages that appear on the screen to understand which button is responsible for entering the BIOS. The required line will look like: "Press [button name] to enter setup".
After entering the BIOS, go to the "Advanced" or "Boot" tab, and in the "First Boot Device" line, select "CD-ROM" or "USB". To exit with saving changes, go to the "Queet" tab and select "Exit and Save". The computer will automatically restart and start using the device that was previously specified by the user as a system device.
Computer check
If your drive has shortcuts instead of folders, you cannot restore folders on a USB flash drive without a full scan. Of course, you can reset the attributes and save all the data in a different place, then format the device and forget about the problem, but this solution method cannot be considered complete, because it is impossible to track the operation of the virus. It is likely that he is already “hosting” the computer in full force.
On the initial screen of the LiveDisk bootloader, a menu with the following items will be displayed:
- Default (regular download).
- Safe mode (safe mode that can help if the previous version does not work).
- Start local HDD (boot from hard disk).
- Testing Memory.
You must select either the first or second item.
Wait a bit until the desktop appears. At the same time, Control Center should start automatically. If this did not happen, click on the analogue of the "Start" button, which is located in the lower right corner of the desktop and looks like a spider, select "Control Center".
In the top menu of the window that opens, you will need to click on the "Tools" item and select the "Settings" line. The first tab will provide a selection of actions applicable to hazardous objects. Set each line to "Delete."
The second tab is called "Scanner". In the lower part there are two input fields. The first sets the maximum size of scanned files. It is better to set the value to "0" to disable the restriction. The second sets the maximum number of checks for one file. It is recommended to set the value to "5". And be sure to check the box next to "Scan archives". After setting, the window can be closed.
In the "Control Center", open the "Scanner" tab and select "Custom Scan". Here check all the drives and click on the "Scan" button.
The scan time depends on the size of all hard drives and their speed. Be patient. After checking, click on "Exit". Do not forget to change the values in the BIOS to those that stood before the launch of LiveDisk.
Attribute Recovery
If folders have become shortcuts, the solution to the problem is not only to scan your computer and drive for viruses. After removing the malicious code, all files and directories must be returned. As noted earlier, they remained on the flash drive, but are hidden from the user. A simple change of attributes made it possible to appear that there are no directories. Changing them in the same way will allow the content to be displayed again. There are several ways to help you complete this operation.
Method one
Open a Windows command prompt. For this:
- Click on the "Start" button and select "Run."
- Type "cmd" in the information input line and click on the "OK" button (or just press "ENTER" after entering). The command line will open.
- First, enter the command "cd / d X: \" in it and press the "ENTER" key. Instead of "X" you should indicate the drive letter installed in your computer.
- With the following command, enter "attrib -s -h / d / s".
After performing the above steps, the files and directories will return to their rightful place. You can continue to work with them, as before the virus attack.
Second way
If the files on the flash drive become shortcuts, you can automate the process of resetting attributes to the initial ones. But for automation, you have to do a simple procedure:
- Open the notebook. This can be done from the Start menu by following the path "Accessories - Notepad", or by entering "notepad" in the "Run" window.
- In notepad, type the line "attrib –s –h / d / s".
- Click on the word “File” in the top menu of the program and select “Save”.
- Specify a name for the saved file, for example: "name.bat". Be careful: after the point you must write "bat", otherwise the file will open in notepad, which will not lead to the desired result.
- Move the saved file to the root of the flash drive.
- After copying, just run it like any other program.
- You can leave the file in case the virus resides on the USB flash drive.
Prevention
If shortcuts appeared on the flash drive instead of folders, but this was not the first time, a great way to protect your machine would be to disable startup from all devices, whether it be a USB drive, at least a hard drive, or a DVD drive.
The fact is that when you connect any drive, the operating system reads a list of files. This is very convenient, because you can configure it to automatically turn on the player when you install the music disk, and if there are a lot of text files on the USB flash drive, its contents automatically appear in Explorer. But only if "autorun.inf" is in the root of the device’s file system, the OS ignores any such settings and executes the commands written in this file. You can use this OS behavior for both good and bad, which is what virus creators use. It turns out that at first the malware code is copied to the computer using this file, and then the machine itself writes these files to each new drive, and the files on the USB flash drive become shortcuts.
The proposed prevention option is perfect if the flash drive is often used on different computers. That is, malicious code located on a foreign machine can be written to the drive, but it will not be distributed on the local computer. It remains only to check the USB flash drive with antivirus tools and restore the directory attributes.
In the Windows OS, starting with Vista, autorun can be disabled in two ways. The first option, which is not suitable for owners of Windows XP, is as follows:
- Open the "Start" menu and select "Control Panel" in it.
- Here, find the item that says "Startup".
- Uncheck the checkbox next to the line "Use autorun for all media."
The second method is more complicated, but it can also be used if the files on the USB flash drive become shortcuts and Windows XP is used on the computer:
- Open the Start menu and select Run.
- In the line of the window that opens, type "gpedit.msc" and press "OK" or "ENTER". Group Policy settings will open.
- In the left part of the window, expand the path "Computer Configuration" - "Administrative Templates" - "Windows Components" - "Startup Policy".
- The right side will display the possible settings. In the drop-down menu you need to select the option "Disable Autostart", and then click on the "OK" button.
- Changes will be saved, but will not take effect until the computer restarts. You can get around this limitation.
- Open the Run window and enter the gpupdate command in it. A command line will appear on the screen with the inscription "Update Policy". The operation will take several minutes, after closing the window, the changes will be applied.