Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
How do I get rid of malicious spyware, malware, viruses or rootkits from my PC?

I have a virus that renames all jpg file extensions to EXE files and hide the original files at the same folder!! I can see hidden Files with FarManager and I cannot see them in Windows Explorer(even with show hidden files option?!!)

How can I restore it to its original file extension? Do you have any tool to scan the converted file and restore it to its original file extension? What the virus name? how can I remove it manually?

share|improve this question

marked as duplicate by Bob, Mokubai, sudo, ChrisF, Hennes Jan 1 '13 at 13:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

6  
Please try kaspersky or AVG Free, imho they are better than Norton and free. –  Nathan Adams Jun 5 '10 at 23:02
4  
Actually, I'd recommend Microsoft's Security Essentials. They made the operating system, I think they know how to make the quickest AV for it. Oh, and don't forget the best part - it's free. –  Breakthrough Jul 8 '11 at 1:42
    
The hidden files probably have a system file attribute set. Enable showing both hidden and system files, and they should appear. –  TuxRug Jul 8 '11 at 5:51
    
Huh? Sircam's back? –  Fiasco Labs Nov 13 '11 at 21:12
1  
I'd suggest that you find a teenager who can find it, then ask him to find it. –  Daniel R Hicks May 17 '12 at 11:34

2 Answers 2

What AV program are you running?
Have you tried running a full system scan with up to date definitions?
The only reference I can find to the problem that you are having is in an archived Forum from 2001: http://forums.devx.com/showthread.php?t=34744
Without knowing the name of the virus it would be very hard to give a solution to removing it manually.

share|improve this answer
    
I got Norton Corporation with the latest Virus Definition. –  user29373 Feb 25 '10 at 10:09
    
Have you tried running a full system scan? If that shows up nothing then try running an online scan, i know Kaspersky have a very good online agent. You may have to turn Norton off, i'd read the users guide on Kasperskys Site: support.kaspersky.com/viruses –  Joe Taylor Feb 25 '10 at 13:01
    
In addition to Joe, run a full system scan with Malwarebytes' Anti Malware, you can remove it afterwards... Kaspersky + MBAM usually does the trick with me! ;) malwarebytes.org/mbam.php –  BloodPhilia Jul 23 '10 at 11:49
    
@user29373 Here are other newer variants virus-com.com/viruscom/viruscom_74397.html . I still dont get the question, Are the files being renamed, or is the name of other files being used to create the "copies" of the virus? You said " they still exist hidden" and "how do I turn them back to original extention" ?? First (as always) you must find and stop the thing doing it. –  Psycogeek Jan 13 '12 at 13:34
    
@Psycogeek -- As I read it, JPG files are being replaced with files with the EXE extension. Presumably this is because a virus has installed malware in the files and wants them to be executed when clicked on (assuming the user doesn't see/care about extensions). A crude but modestly effective strategy, if the virus writer doesn't mind nearly immediate detection. –  Daniel R Hicks Aug 26 '12 at 22:40

I think you'll need to get a decent AV (which is open to debate what is best, but for my money I go Kaspersky and never use a free one) and clear the infection.

As for restoring, I think a system restore is the only option here. There is no way for the OS to tell what file type used to be what file type.

If the restore fails, the only other thing you could try is changing all .exe to .jpg, testing them, and if they work, keep them, if not, return to .exe but I would be amazed if this software exists as is so I guess it would be a manual task (search in Windows for *.exe) and starting renaming!

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.