Danish asks:
Due to some virus on my computer, all folders on external memory connected to the computer used to turn into .lnk files, pointing to the actual folder location. It used the virus file to function. I ran a virus scan and deleted the virus after mapping it out.
However, now, due to unavailability of the malcode, the .lnk associations on the external hard drive aren’t working. The memory details of my external drive say that all data is still present on it, but it’s gone somewhat hidden, meaning I can’t access it because the original folder doesn’t show up, and the .lnk associations aren’t working because of non-availability of the virus code.
What do I do to recover my data? Kindly reply. Thanks
22 Answers -
Rodrigo
April 30, 2011Hi, friend.
The virus you’re talking acts by installing itself in your external drive, hiding your folders as system protected files and then creating false folders with the exact same icon and name which serve as shortcuts to the virus itself. As you say you already removed it, all you have to do is change your folders back to a normal state. Here’s how you do it (assuming you’re using Windows):
1)Open up Folder Options (you can find it in the Control Panel or under the “Tool” menu on Windows Explorer);
2)Click on the “View” tab;
3)You will see a list with a lot of checkboxes, go ahead and check “Show hidden files and folders”. Also make sure you uncheck “Hide protected system files”;
4)Now go to your external drive and you will see your folders back. Unfortunately, they cannot be changed back into regular folders manually (at least not in an easy way), so you will have a bit more work to do here. You have to create new folders somewhere else in your computer, (for example, inside a “usb backup” folder in My Documents) with the same names of the folders the virus affected. Ignore any folder with weird names (e.g folders you didn’t have before catching the virus), as they may still contain undetected malware. You can also ignore the “RECYCLE” folder, as it is automatically created by the system if needed;
5)Now you can copy the contents of each individual folder into its duplicates, as the files itself will probably be untouched by the virus;
6)After you’ve finished copying the files, backup the files you still have in the drive’s root folder (the one you first open when browsing your external drive), again ignoring any files with weird names, for the same reasons above.
7)Now, as a last safety measure, format your drive, to make sure you get rid of any possible virus.
8)Finally, copy your files back into the drive and you are good to go!
Best Regards!
Thanks a lot Mr. Rodrigo. I try your steps and my problem was solved.
July 18, 2011hello there, rodrigo , ur soln is extended so here is bypass use
October 24, 2011attrib -s -h -r *.* /s /d
this wll clean all up
thanks
Thanks a lot Brother. It really helped me a lot. No other website is as user friendly with loads of easy steps as yours.
Love you.
January 8, 2012Thanks buddy…………
March 6, 2012Thanks you very much Rodrigo your info. help me very much.. I got that trojan virus to my father’s laptop because his laptop’s antivirus is outdated lol xD Thanks again.. Two thumbs up for you there :)
March 13, 2012tanx a lot….really very useful
April 15, 2012Tina
May 1, 2011Danish,
did Rodrigo’s explanation help you to solve the problem? Please let us know in case you need more help. Thank you!
Osama
May 1, 2011that kind of virus is very dangerous, which free antivirus can catch it? coz i’ve my data on an external drive too
Try Avast antivirus pro
March 13, 2012Lisam15
May 3, 2011I tried the solution suggested. Went to the folder options and selected the “show hiden files and folders”, unchecked the “Hide protected operating system files”, and pressed apply. However the folders didnt show, and when i looked at the folder options the “Hide protected operating system files” option was checked again. I tried several times and the same thing happens. Any help on this?
Hidden file visibility has been disabled in the registry. Here’s an easy fix:
http://forums.techguy.org/dos-other/728285-batch-file-enable-diable-hidden.html
May 18, 2011Danishpatel1849
May 8, 2011@Rodrigo:twitter : Thanks alot. I tried it out and it did work well. Only now, the virus keeps coming back again and again. Every time i plug in my external drive, i have to manually delete RECYCLER folder in order to prevent the shortcut tragedy occuring. My Avast anti-virus detects the file as a virus and deletes it every time, but it still keeps coming up. From what i’ve found out, its called the Ramnit virus.
@Lisam15: Thats wierd….i think it has something to do with administrator previlidges….not much idea on the subject really though.
Rodrigo
May 9, 2011@Danishpatel1849:disqus : Well, i’m afraid you computer is actually the source of the virus wich is infecting your drive. As a first option, try starting windows in safe mode and do a full antivirus scan in all of your drives and maybe try running some anti-spyware as well (i’ve seen spywares do some crazy stuff, like opening and closing cd trays at random). If that doesn’t work, you can either try reading the link i will post below, to see if it helps, or go ahead, backup your files, taking care to not include any virus in your backup (leaving out any file with weird names or .exe, .com and .bat files helps a lot here) and format your system, followed by a clean OS install.
@acdfaa50bf0ff259adede072a2ddb4fd:disqus
, and maybe
@6ed3a419551077d68de33abd7666b632:disqus
too: you could try reading this :
http://www.techtalkz.com/computer-security/476579-i-cannot-uncheck-hide-protected-operating-system-files-recommended.html
Maybe that helps
!
Best Regards!
Rodrigo,
please contact me immediately for good news!
May 12, 2011tina at makeuseof dot com
Thank you!
You have 24 hours to get in touch with me or the good news will be forfeited. Sorry!
May 14, 2011Hey, Tina, i’ve just sent you an e-mail, under the subject “News”. Sorry for the late reply, the internet wasn’t working. I hope i’m not too late!
May 14, 2011sohail
May 13, 2011Thank you Boss. It was very helpful. best regards
nads
August 31, 2011wow thanks a loooot… i had thought i ve lost all my files
Pete
September 27, 2011Hi guys! I have the same problem as the opening post. But the only difference is, I use a Mac. My external is FAT 32 formatted, it was working fine till yesterday. I used to plug into my tv to watch movies and pics. But suddenly yesterday all the files in my hd turned into .lnk files. I installed winShortcutter and Crossover but none of them worked. The HD shows used space of 250gb but all files are 4kb in size.
Please help me gurus as the data is precious to me.
Thanks
Hi Pete,
Try and click on Tools -> Folder options -> View -> and untick ” Hide protected operating system files” and tick ” Show hidden Files and Folders”.
September 27, 2011I am sure you will be able to see your files. Unfortunatly, you will need to recreate the main folder and just copy and cut the data to the new folder.
Thanks Marnitz! It worked. I was just trying to do it from Mac but I had to use Windows Laptop to transfer it. Thanks a ton
September 29, 2011It’s a pleasure Pete. Glad it worked.
September 29, 2011Thanks for the feedback, Pete!
September 29, 2011Pmecca
October 22, 2011I have the same problem as Pete. I was using an external 80gig portable drive. Originally was formatted for Mac, but my son used it to “clean up” his PC and when I went to use it everything was turned into shortcut and alias files with zero KB size files. I tried to run a scan on a pc and clean up the virus. I also checked “Show hidden files and folders”. But now the drive says there is almost a full 74 gig of usable space, so I fear the drive has been wiped.
All my school projects – gone. I’m sick. If you have ANY ideas or think I can still recover data, please let me know
Ivanchea
October 25, 2011This post is rwarsome!!!!
Anish
November 13, 2011thank you very much Rodrigo …..
I owe u a lot of respect .
bcoz of u i have recovered my precious data…..
Robert Dharmawan
November 20, 2011the easy way is go to your flash disk drive then go to Tools –> Folder Options on View Tabs Remove check box on “Hide operating system files” then you will see all your hidden folders.
Gavaskarv
December 7, 2011How to do it in MAC os
junyuan_2210
December 16, 2011try this
http://www.youtube.com/watch?v=5o-iO49C0fA&feature=related
iPhone App Development
January 20, 2012i had same problem and i searching about this on search engine and i got this information on this blogs, i read this and i fixed my errors. its really great stuffs.
Marjorie
January 24, 2012I have just started the process but what i have seen far is just too good, thanks a lot
amielDH
February 12, 2012GOD! you’re a life saver! thank you so much! I’m copying all my files to my backup drive..thank you again!
Rox My Volleyball Sox
February 20, 2012OMG THANK YOUUUU!!!!
abhishek
April 16, 2012download
“USB show” from internet
it just recovered all my files within a minute
Thanks dude … it worked … but how do i get rid of this virus for good ??
May 7, 2012Run a full system scan with your AV software. Also run a full scan with something like Malwarebytes or Spybot S&D. They will generally find and remove the crap that keeps fudging up your system.
May 8, 2012thanks dude … it worked !! But, how do I get rid of the virus for good ?? Plz help me out
May 7, 2012katie
May 3, 2012I know you guys went through this but my usb turned all my FOLDERS into .lnk files, but my other single files are fine. But this virus came from my teachers comp at school and i use a macbook so i have no idea how to repair the files. I tried terminal and disk repair but nothing works. Help please???
on your teacher computer
http://www.winhelponline.com/fileasso/lnkfix_vista.zip.
extract and click on it
or
http://www.winhelponline.com/fileasso/lnk_fix_w7.zip
http://www.winhelponline.com/fileasso/exe_fix_w7.zip
Show Hidden Files
May 3, 2012http://www.mactricksandtips.com/2008/04/show-hidden-files.html
Type this command, then press enter
defaults write com.apple.finder AppleShowAllFiles TRUE
To allow the files to be shown, you must restart Finder
To hide files again, type:
defaults write com.apple.finder AppleShowAllFiles FALSE
restart Finder.
You can also restart finder by using the following command from the terminal:
killall Finder
They are not virus and just link to files and folders.You can prevent or might fix it by using the software below -
http://www.lobotomo.com/products/WinShortcutter/index.html
May 3, 2012JVILLA1974
May 7, 2012please help, how do I do this on my mac, I have a external hard drive and all my folders are showing the .lnk extension, how do I get my files back PLEASE HELP!!!
Just follow ha14′s instructions below!
May 8, 2012