Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Here is what happened after I used Malwarebytes Anti-Malware:

1

Before I used Malwarebytes Anti-Malware I could still open that shortcut. I know that a virus made that shortcut and so I tried to remove it, but after using Malwarebytes Anti-Malware things are worse. I can't even open the shortcut now. Can someone help?

share|improve this question
    
I would recommend that if it's possible you should just format the drive and restore your data from backups. If that's not a possibility, once you're sure the malware's been removed you can try running a few data recovery utilities and see whether they can hopefully recover the original data. –  Karan Mar 4 '13 at 3:05
1  
im not sure if i have backups.. and that would be my last resort is to format and try to get a data recovery.. thanks –  Centchua Mar 4 '13 at 3:39

2 Answers 2

up vote 3 down vote accepted
  • view hidden files and folders AND system files. Maybe the virus set the "hidden" attribute on all your data. I can see from your screenshot that the shortcut is only 698 bytes, so it is a real shortcut, rather than a folder made to look like a shortcut by the virus. In other words, the data was never inside it- yet it was still on that drive. This means the data must be in a hidden folder in the root directory of the external hard drive.
  • Look at the total data on your external drive (right click on the external drive and open "properties"). I doubt it's empty. Check it out- what you see will probably be reassuring.
  • delete the "autorun.inf" file the virus created, and anything else hidden in the root you recognize as having been created by the virus. You want to manually clean out any monkey business the virus hid on that drive so it starts behaving properly again.

Here's how to view hidden files and system files:

enter image description here

share|improve this answer
1  
dude thanks for help.. but i reduce the problem now.. i already tried that view hidden files and folders but nothing happens.. now i can view all the files and that "autorun.inf" is removed.. i used Recuva.. but the thing is it is still in shortcut.. i46.tinypic.com/fm8juh.png to i47.tinypic.com/21j7tpv.png –  Centchua Mar 4 '13 at 3:36
2  
You need to view system files as well, not just hidden files. There are still some hidden virus remnants in the root of the drive. It'll be obvious when you see it. Once you remove these remnants- disconnect and reconnect the hard drive and it will appear as normal again. –  Austin ''Danger'' Powers Mar 4 '13 at 3:40
    
how to view system files ? –  Centchua Mar 4 '13 at 3:55
1  
I wouldn't put that drive in another PC until you've disinfected it on this one. The last thing you want is it spreading around. It very likely attempts to use autoplay to infect other systems this way. There is no guarantee another antivirus will catch it as it could be something new and unrecognized. –  Austin ''Danger'' Powers Mar 4 '13 at 4:02
1  
here is what happen after i view system files.. i dont know what to delete.. i dont want to lose my files i48.tinypic.com/2962i2q.png –  Centchua Mar 4 '13 at 12:30

Hey I have encountered the same problem and the solution is simple!

What the virus does is: 1. Move all your files to a single folder (the name of the folder is ' ') 2. Hide that folder with attributes SHR (System, Hidden, Read-Only)

The trickiest part is that the shortcut lets you access your files if you open it but will run a background virus as well.

Solution:

  1. The shortcut is irrelevant, you might as well delete it.
  2. Set show hidden files and folders AND system files on
  3. Uncheck 'Hide protected operating system files' Look at 'Kim Jong-Un' answer for details
  4. You should find a folder with no name (actual it is named by a simple space which you can write by the unicode (ALT+0160)
  5. Open the folder to access your files and unhide it for later use by going to properties

N.B. If the virus is on your PC, I recommend you no to move your files back out of the "space" folder unless you clean your PC, because all the moving of files will possibly make you lose your files.

I would have posted a screen-shot but my rep is low I guess.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.