I loaned my flash drive to someone who used said drive on a Windows machine infected with a virus. My flash drive subsequently got infected with a virus that changes folders to executables.

Research on the virus revealed that it actually hides the folder, then creates an executable with the same name as the folder such that the virus is executed when the user unknowingly clicks on any of the infected folders. This means in theory my original folder should be visible when i unhide all hidden files and folders.

I have a Mac and have unhidden all files and folders but I can't see my folder of interest.[The infected folder that I want to recover is called "University" and as you can see it's listed as an executable.]
Here's a screen shot of my drive with all files unhidden: enter image description here

Can anyone please recommend a method to get rid of the virus and recover the folder from an OSX machine? Thanks.

migrated from security.stackexchange.com Apr 2 '15 at 7:35

This question came from our site for information security professionals.

  • 2
    Couldn't you just format / re-partition the flash drive to make it usable again? – Joseph Apr 1 '15 at 20:26
  • 1
    You have backups, right ? – user256743 Apr 2 '15 at 1:06
  • Loaning a USB is like loaning your significant other, you can never be sure what you get back... – Fiasco Labs Apr 2 '15 at 4:39
  • @Joseph No I want to recover the data, not re-format. The drive itself s fine. – xupv5 Apr 2 '15 at 5:26
  • 1
    Mac doesn't respect the NTFS hidden flag even without show invisibles on, so it does look like the folder is gone – Tetsujin Apr 2 '15 at 7:47

Since your screenshot shows "System Volume Information" hidden folder, but not "University" I suppose your folder of interest got deleted. Note that it is also impossible to have a file and a folder which have exactly the same name, so the executable probably overwrote your folder.

Your best bet is to try some kind of undelete tool; otherwise your data seems gone.

  • The files don't have the same name, but ".exe" appended to it. Although I don't see any such on the screenshot. +1 for undelete/recovery tool. I'll risk and mention Recuva as its free and good (as it gets). Otherwise people might either ask for a recommendation anyway, or worse, download some scamware. Or payable tool. – David Balažic Apr 7 '15 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.