Worm attack!!!

Solved/Closed
Anabastha - Aug 22, 2010 at 09:07 AM
jack4rall Posts 6428 Registration date Sunday June 6, 2010 Status Moderator Last seen July 16, 2020 - Apr 15, 2013 at 06:52 PM
Hello,




all the files and folders in my external hard drives have converted to shortcuts with .scr extension and won't open.....
i am not sure if my original files still exist and i cannot afford to delete them....plz help!!!!

3 replies

jack4rall Posts 6428 Registration date Sunday June 6, 2010 Status Moderator Last seen July 16, 2020
Aug 22, 2010 at 10:14 AM
Hello,

Check whether the files are not in hidden mode.

Click on "Start" -->Run-->type cmd and click on OK.

Command Prompt will be opened.

Here I assume your external hard drive letter as G:

Enter this command.

attrib -h -r -s /s /d g:\*.*

Press Enter.

Note : Don't forget to replace the letter g with your external hard drive letter.

Now check for your files in external hard drive.

After that, download the Malwarebytes' Anti-Malware from the below link

https://ccm.net/downloads/security-and-maintenance/4621-malwarebytes-anti-malware/

Update it --> Perform "Full Scan"

Note : Default selected option is "Quick Scan".

Good Luck.
1
hi jack,

firstly thank you so much for your help...

i tried everything you had told me....using d command prompt shows me all my files and folders back but the shortcuts remain. These i deleted and then did a complete scan with malware who after the scan asked me to restart, but on restarting d shortcuts were back again and my files and folders were again hidden.
So i assume that the virus/worm is still there.
0
jack4rall Posts 6428 Registration date Sunday June 6, 2010 Status Moderator Last seen July 16, 2020
Aug 22, 2010 at 04:09 PM
Hello,
Try this 1.
1)Disable the autoplay.
Click on Start --> Run --> type gpedit.msc and click on ok. Now navigate to this location.
Double-click on "Computer Configuration" --> Administrative Templates ---> System.
Double-click on "Turn autoplay off" option and select the option "Enabled" --> OK. close that window. Now logoff and logon into your account.

2)Copy the text starting from "REGEDIT4" upto @="@SYS:DoesNotExist" ---> open notepad -->
paste it ---> save the file as fix.reg
Note : Don't forget the extension reg.

Now double click on fix.reg ---> Click on OK.

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

Note : After following the step 2, whenever you place any autoplay cd all you have to do is go to my computer --> open the cd drive ---> you have to double click on the setup file in future.

3)Update your antivirus and scan your PC first. Then connect your external harddrive & scan it.
Good Luck.
0
asiantrd786 Posts 1 Registration date Monday April 15, 2013 Status Member Last seen April 15, 2013
Apr 15, 2013 at 03:55 PM
same problem i am facing with my external hard drive. when i open my folders shows error .scr mean virus is there? i disable auto run but when i make fix.reg file and try to open that again i receive error there. cannot import d:\fix.reg: the specified file is not a registry script. you can only import binary registry files from within the registry editor.
0
jack4rall Posts 6428 Registration date Sunday June 6, 2010 Status Moderator Last seen July 16, 2020
Apr 15, 2013 at 06:52 PM
Hello asiantrd786,
Try this 1
Try the below given manual method.
Click on Start --> Run --> Type regedt32 and press Enter. "Registry Editor" will be opened.
First backup your registry by going to "File --> Export". Save the file with any name in your desired location. Now at the left, navigate to the below location.
HKEY_LOCAL_MACHINE --> SOFTWARE --> Microsoft --> Windows NT --> CurrentVersion --> IniFileMapping. Now under "IniFileMapping" look for the "Autorun.inf". If it doesn't exist then right-click on the "IniFileMapping" --> Click on "New" --> Key. Now enter the key name as Autorun.inf. Now make sure that "Autorun.inf" is selected, on the right side double-click on the "Default" and enter the value data as @SYS:DoesNotExist and click on OK.
Good Luck
0
hey jack,

tried the second step and my problem is solved now....
thnx a ton!!!....

n oh varfendell thnx 4 ur help 2....:)
0