Why were the folders on my memory card converted into EXE files and how do I get my data back?

Alka S July 21, 2013
Pinterest Stumbleupon Whatsapp

If I plug in my external hard drive or memory card into one particular laptop at home, it converts some of my folders with movies downloaded into application files that can’t be opened.

Is it a virus that does this? Can I convert them back?

Fortunately, so far it has been only movie folders, but I’m afraid that soon it will do it to my important work folders as well!

Ads by Google

  1. Abdul B
    July 28, 2013 at 2:03 pm

    i deal with this virus on daily basis i run a computer shop and people come to get prints with usb when u get this virus "clicking show protected+hidden+system files&folders from folder option" will not show hidden files even if u are not infected u can not modify file & folder attributes

    here is the ultimate cure

    use "usb show" to show hidden files fron flash / memory card

    type flash / memory card drive letter in in "RUN" X:

    with extreme care delete all exe files and autorun.inf

    for help plz chk these links

    http://2.bp.blogspot.com/-xoHK4EF5oIs/T3BrLtKumfI/AAAAAAAAAq0/ImUxiBj8Loc/s400/3.PNG

    http://www.flashdrive-repair.com/2013/04/recover-your-usb-flash-drive-hidden.html

    http://www.askvirus.com/wp-content/uploads/2011/04/121.jpg

    http://www.youtube.com/watch?v=uH-7PezrA1Q

  2. Ankur Sharma
    July 24, 2013 at 1:09 pm

    I mostly use the console based approach.
    1) windows key + Run
    2) cmd
    3) Presumption: F:\ is the flash drive
    4) Type F: on the prompt
    5) dir /a
    6) you can find the files which have been created as .exe or which are hidden (the one which stats with a . followed by the name of the file)
    7) now you can use the copy command and copy the file which you need to a hard disk and delete the file with .exe extension.
    Hope it helps.

  3. Lisa O
    July 23, 2013 at 6:04 pm

    It's very common that the virus simply hide your real files. Scan and clean the memory card, delete those EXEs, then click organize>folder and search options>view>unclick 'hide protected...'. If you can see your folders, that's good. Now go to command prompt and type this to unhide them:
    attrib -h -r -s /s /d x:*.*
    Replace x with your memory card's drive letter.

  4. Alka
    July 23, 2013 at 1:51 am

    Thank you for your help everyone. Will try your suggestions.

  5. Oron J
    July 22, 2013 at 12:57 pm

    Sounds like a virus. You can use a bootable disc (DVD/CD/USB) such as Kaspersky Rescue Disk, AVG rescue disc or Trinity, as mentioned by Bruce, or you can simply download and run Malwarebytes Antimalware Free to remove it.

  6. Bruce E
    July 21, 2013 at 12:25 pm

    I would say your laptop has a virus. Download Trinity Rescue Kit or a similar bootable CD/DVD and burn it to disc. Boot your laptop from this disc and kieep re-running the scans until it comes up clean. Boot your laptop into Safe Mode with Networking, install & update Malwarebytes and keep running scans until it comes up clean. Reboot the laptop normally and update the operating system and antivirus product you are using. If you don't have AV on the system, at least install one of the free ones (with the exception of AVG - it is becoming too much of a resource hog).

    Run AV and Malwarebytes scans across ALL other devices you have ever connected to this laptop until they all come up clean. Depending on how the files & folders were infected, you may find that they end up being deleted, quarrantines or possibly have the virus removed from them.

    If the files & folders were infected by putting the original content inside of an executable wrapper, the AV software may be able to remove the virus and save the original content, but it may not change the file extensions back to what they should be. It is also possible that the virus simply renamed the files and access can be restored by changing the file extensions back to what they should be.

    You should download the GNUWin32 file utility and run it against all questionalble files. It will tell you what type of file it is by looking for "magic numbers" in the headers of the files. This is more reliable than relying on the file extensions as Windows does. IF ANY OF THE AFFECTED FILES THAT WERE NOT EXECUTABLE (VIDEOS, PICTURES, ETC) RETURN A RESULT INDICATING IT IS AN EXECUTABLE FILE, DO NOT ATTEMPT TO OPEN OR RUN IT AS IT WILL MOST LIKELY INFECT THE SYSTEM YOU ARE USING. If a file returns a result of the various video file container or image types, simply rename the file if the extension does not currently match what the file utility returns as a result.

  7. Hovsep A
    July 21, 2013 at 11:15 am

    file association problems?
    http://www.dougknox.com/xp/file_assoc.htm
    http://www.briteccomputers.co.uk/downloads/xp_fileassoc.zip

    Windows Repair is an all-in-one repair tool
    http://www.tweaking.com/content/page/windows_repair_all_in_one.html

    1) On Windows xp Go to control Panel, Folder Options — select VIEW— select Show hidden files and folders and uncheck Hide protected operating system files and click APPLY
    2) Go to your memory card delete the virus and all the shortcut folders that have
    no data in them. create new folders (give the same name as your normal non infected hidden folders) and copy the data from YOUR hidden folders
    into them. once that is done delete the old hidden folders.
    3) Open task manager— find the virus program that is still running which will
    have the same name as the one you just deleted off the memory card d
    4) Go back to control panel, Folder options select view- select DO
    NOT show hidden files and folders and recheck Hide protected operating system
    files (recommended).

Ads by Google