I have had way too many complains about files an folders hidden or presumably deleted by viruses and replaces with shortcuts. This happens after plugging the storage device into an infected computer or plugging an infected storage device into a computer. I always advice you be sure the destination of your storage devices before you plug in to the computer. By storage devices I mean, HDD, flash drive, SD card, mobile phone. In the eyes of a computer, they are all storage devices, and the virus knows that too. This is a Microsoft Windows problem.
I first had a personal experience with this situation in 2007. I did notice the size used on my HDD was the same but a lot of folders had disappeared. It was new to me then so I didn’t know the best way to resolve it. I knew if I formatted the HDD, I would lose all of the contents. So, I did a full HDD delete recovery. It worked quite well but it took about 6 hours. Long ting. The recovery process brought back the viruses that were deleted along with my missing files and folders. I used Kaspersky to do a full scan and all went well.
Today, this same virus threat seems to be lingering. I have heard stories of how people have had to format both computers and storages just to get rid of this same infection.
Note, I am showing you how to restore these hidden files and folders and not how to get rid of the viruses. In 2009, I found a cumbersome way to restore the files and folders and also remove the virus. This virus keeps evolving. It’s quite different from the way I knew it in 2009. Back then, you could just plug your storage device into a Linux or Mac computer. The hidden files and folder would be visible. Then you recreate each folder and move their content into it the delete the old folder. Today, these virus has found a way to blind Linux and OSX from seeing these files.
First of all, install a very good antivirus. I’ll recommend Kaspersky or BitDefender. Make sure it activated (even if it a trial version) and updated online. Don’t bother doing a full scan at this point.
Make sure Windows account you’re using is an administrator account. Run CMD (Command Prompt) in administrator mode.
If the affected device is an external storage device type the drive letter and : (e.g. F:) then press enter. If the affected device is your computer, my advice would be to go to the root directory on your HDD. On the Command Prompt, type CD/, the press enter. Then type these command as you see them, attrib -s -h -r -a /d /s. Let the process run until you see the C:\ again. At this point all types of hidden files are being exposed so you might notice frequent notifications from your antivirus.
Once this process is completed you can now do a full scan with your antivirus.
If the virus came from a CD/DVD it means the virus has been immortalised. Destroy the disk!!!
In some cases, the HDD might have sector damage, and it may prevent your from functioning properly, whereby making the ATTRIB command not able to execute its task. For this situation, use the CheckDisk and fix command – CHKDSK /F.
In some cases, the virus changes the storage drive icon into a folder icon. You might still have the folder icon after the above procedure. To retrieve your icon, you will need to check your root folder for AUTORUN.INF or AUNTORUN.INI. Delete them. If your storage drive came with a custom icon, it means it had the autorun files from the start. At this point, it really doesn’t matter any more as i has already been compromised. If you still want your icon back, do not delete any .ico file on your root folder. I’ll show how to restore those icons in a later post. Also, delete the RECYCLER folder too.
Please, let us know if this post was helpful. You can contact us or leave a comment on this post