0

Yesterday I traded some files with a friend by hooking up an external hard drive to his computer. I had created a folder with some files in it for him and likewise created another folder for him to copy miscellaneous audio and video files into. Everything seemed to work normally.

When I got back home and plugged the drive back into my laptop, my virus protection picked up something strange, but was able to remedy it immediately. The drive is working normally, and everything else on it is as it should be, but the folder that my friend copied files into is completely empty. Also, the folder I had created with stuff for him is missing entirely, including the folder itself. However, I can see from the amount of memory being used that all the files in both folders are still there somewhere. To make matters even weirder, a separate .rar file he had copied onto the drive containing some picture files is there and working completely normally, so not everything we copied was affected. And, as I said, everything else on the drive appears as it should be.

I've tried making hidden files visible in my "View Folder" configuration, and also tried to do so through the Command Prompt, but neither had any effect. Has anyone encountered something like this before and, if so, how did they fix it?

Improve this question
2
  • 1
    Which AV software, what does the AV software log say, were the items quarantined/deleted?
    – Tog
    Aug 3, 2013 at 12:44
  • You make hidden files and folders visible: don't forget the system hidden files. You can do it easily with this: bleepingcomputer.com/download/show-hidden instead of Windows GUI or command line.
    – climenole
    Dec 25, 2014 at 13:10

3 Answers 3

Reset to default
1

You may need to "take ownership" of these folders. If you are using NTFS it has a security feature which can lock you out of folders.

My computer select the affected drive. Right click and click on properties. Goto the security tab and click "Advanced" Click on Owner edit Select either your username,Administrator, or Everyone check the box "Replace owner on subcontainers and objects" Click OK

Wait patiently for the operation to complete. Then check and see if that helps.

Improve this answer
1
  • It would be unusual for external media to use NTFS, Fat32 or exFat are much more common in external storage devices for cross-platform compatibility reasons.
    – Cliff Armstrong
    Jul 14, 2017 at 2:10
0

This is a VERY common virus which reproduces itself by making a copy of itself onto any USB device plugged to the infected computer. I bet the antivirus would have deleted these files - 'New Folder.exe' , 'autorun.inf' and 'Recycler'.

Your friends folder has not been deleted. It has simply been hidden.
To view hidden folders,
On an explorer window,
GO to Organise --> Folder and search options --> View --> Select Show hidden files and folders --> Apply.

Now the folder will become visible.
Right click on it --> Deselect Hidden checkbox and click apply.

Improve this answer
10
  • Thanks for answering, but as I wrote, I already tried making hidden files visible, and the files are still not there.
    – John Morgan
    Aug 3, 2013 at 12:20
  • The newer version of this virus regenerates itself as soon as the antivirus deletes it. Update your antivirus and run a full system scan. To access the folder, try remembering the folder name and access it by directly writing its path in the path bar.
    – user241704
    Aug 3, 2013 at 12:23
  • I have Kaspersky and it hasn't detected anything with quick scan. A full scan will take a while. In the meantime, the files still are not visible even if I enter its path.
    – John Morgan
    Aug 3, 2013 at 12:34
  • Use command prompt and see if the folder exists. Use dir command.
    – user241704
    Aug 3, 2013 at 13:06
  • One of them is there. The other is still not.
    – John Morgan
    Aug 3, 2013 at 13:32
0

Go to "Start" and type "cmd" in the search bar, . Command prompt will show up in the search - right-click on it and choose "Run as admin". Now, enter the following in the command prompt: attrib -h -r -s /s /d x:*.* where "x:" is the letter of your external hard drive.

Check your hard drive for the hidden folders

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .