Worm attack!!!

[Solved/Closed]
Report
-
Posts
6428
Registration date
Sunday June 6, 2010
Status
Moderator
Last seen
July 16, 2020
-
Hello,




all the files and folders in my external hard drives have converted to shortcuts with .scr extension and won't open.....
i am not sure if my original files still exist and i cannot afford to delete them....plz help!!!!

3 replies

Posts
6428
Registration date
Sunday June 6, 2010
Status
Moderator
Last seen
July 16, 2020

Hello,

Check whether the files are not in hidden mode.

Click on "Start" -->Run-->type cmd and click on OK.

Command Prompt will be opened.

Here I assume your external hard drive letter as G:

Enter this command.

attrib -h -r -s /s /d g:\*.*

Press Enter.

Note : Don't forget to replace the letter g with your external hard drive letter.

Now check for your files in external hard drive.

After that, download the Malwarebytes' Anti-Malware from the below link

https://ccm.net/download/download-105-malwarebytes

Update it --> Perform "Full Scan"

Note : Default selected option is "Quick Scan".

Good Luck.
1
Thank you

A few words of thanks would be greatly appreciated. Add comment

CCM 2942 users have said thank you to us this month

hi jack,

firstly thank you so much for your help...

i tried everything you had told me....using d command prompt shows me all my files and folders back but the shortcuts remain. These i deleted and then did a complete scan with malware who after the scan asked me to restart, but on restarting d shortcuts were back again and my files and folders were again hidden.
So i assume that the virus/worm is still there.
Posts
6428
Registration date
Sunday June 6, 2010
Status
Moderator
Last seen
July 16, 2020

Hello,
Try this 1.
1)Disable the autoplay.
Click on Start --> Run --> type gpedit.msc and click on ok. Now navigate to this location.
Double-click on "Computer Configuration" --> Administrative Templates ---> System.
Double-click on "Turn autoplay off" option and select the option "Enabled" --> OK. close that window. Now logoff and logon into your account.

2)Copy the text starting from "REGEDIT4" upto @="@SYS:DoesNotExist" ---> open notepad -->
paste it ---> save the file as fix.reg
Note : Don't forget the extension reg.

Now double click on fix.reg ---> Click on OK.

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

Note : After following the step 2, whenever you place any autoplay cd all you have to do is go to my computer --> open the cd drive ---> you have to double click on the setup file in future.

3)Update your antivirus and scan your PC first. Then connect your external harddrive & scan it.
Good Luck.
Posts
1
Registration date
Monday April 15, 2013
Status
Member
Last seen
April 15, 2013

same problem i am facing with my external hard drive. when i open my folders shows error .scr mean virus is there? i disable auto run but when i make fix.reg file and try to open that again i receive error there. cannot import d:\fix.reg: the specified file is not a registry script. you can only import binary registry files from within the registry editor.
Posts
6428
Registration date
Sunday June 6, 2010
Status
Moderator
Last seen
July 16, 2020

Hello asiantrd786,
Try this 1
Try the below given manual method.
Click on Start --> Run --> Type regedt32 and press Enter. "Registry Editor" will be opened.
First backup your registry by going to "File --> Export". Save the file with any name in your desired location. Now at the left, navigate to the below location.
HKEY_LOCAL_MACHINE --> SOFTWARE --> Microsoft --> Windows NT --> CurrentVersion --> IniFileMapping. Now under "IniFileMapping" look for the "Autorun.inf". If it doesn't exist then right-click on the "IniFileMapping" --> Click on "New" --> Key. Now enter the key name as Autorun.inf. Now make sure that "Autorun.inf" is selected, on the right side double-click on the "Default" and enter the value data as @SYS:DoesNotExist and click on OK.
Good Luck
hey jack,

tried the second step and my problem is solved now....
thnx a ton!!!....

n oh varfendell thnx 4 ur help 2....:)

Subscribe To Our Newsletter!

The Best of CCM in Your Inbox

Subscribe To Our Newsletter!