Pendrive automatically creates the shortcut folder: Virus FIX

Diego Ce - Apr 8, 2015 at 12:22 AM
xpcman Posts 19530 Registration date Wednesday October 8, 2008 Status Contributor Last seen June 15, 2019 - Apr 8, 2015 at 12:58 PM
After trying all procedures found in different forums blah blah, as of April 8th 2015, installing many maleware, antivirus soft, etc. The following is the
procedure that worked for me and I recommend you to try before intalling too many unnecessary software.

If you do not know what CMD is ..then quit here, or just ask any kid or basic computer knowledgeable person to read this and do it for you.

To CHECK you have this virus try START -> msconfig -> it will automatically close... you won't be able to even keep the window open


start in safe mode with network capabilities (restart -> F8) If you can't then start windows normally and unplug you pc power cord. then you will be given the option of safe mode

download & install malewarebytes

download & install avg

restart system

Control Panel -> Foler options -> View:
- select show hidden files, folders, or drives
- untick Hide extesnions for known file types
- untick Hide protected operating system files
Click OK

Plug in infected pendrives or sdcards

start -> cmd -> copy & paste "attrib -h -r -s /s /d f:\*.*" (without the " " Replacing f: with the drive of you pendrive) if more than one, repeat the command with each mounted drive letter

widnows explorer -> go to each mounted drive -> select all files (do not open any file!) -> shift+Delete -> OK

Now your pendrive/sdcard is empty with no infected files

start->all programs -> maleware->tools->chameleon

Try each "#" option until you get a comand prompt window not suddenly closed and a clean desktop background

do not run malewarebytes, just ctrl+alt+del -> select restart -> "cancel restart" as soon as you see the option when windows is forcing to shut processes

you are back to windows desktop with icons and all (somehow virus process is not running now)

start -> msconfig -> startup -> disable Microsoft Windows Based Script Host

AVG -> Full Scan

AVG -> Options -> Virus Vault -> Virus found ASP/Backdoor -> Select and open folder location

Delete folder (usually c:/users/user/appData/Roaming/*)

AVG -> now clean all detected theats in Vault

Run Full Scan of all drives with malewarebytes -> clean everything detected

Restart Windows normally

START -> msconfig -> it opens ! :) and no microsoft base script is listed

Now copy a file into a mounted drive (pendrive) ... wait a bit ... F5 .. no shortcut created! :)


1 response

xpcman Posts 19530 Registration date Wednesday October 8, 2008 Status Contributor Last seen June 15, 2019 1,825
Apr 8, 2015 at 12:58 PM
thanks for the information