Virus! My files turned into shortcuts (Solved)

Lots of people are having the same problem with a damn virus. It spreads via USB memory sticks or external hard drives, and “converts” all the files into shortcuts.  Fortunately the real files are still there, the user is just unable to see them. We will fix the problem in five simple steps.

Step One

Windows has the bad habit of hiding certain files and their extensions. This may be useful to avoid confusing novice users, but presents serious drawbacks. You may, for example, run a dangerous program like “photo.jpg.exe”because Windows only shows the “photo.jpg” portion. For that reason, and also to help fighting this memory stick infection, you need to make all files visible. The following steps apply for Windows XP, Vista and 7.

1.    Click on Start

2.    Click on Control Panel

3.    Pick Folder Options

4.    >Click on “View” tab

5.    Clear the following check boxes:

6.    Clear the check box “Hide protected operating system files (Recommended)”

7.    Clear the check box “Hide extensions for known file types”

Click Accept to apply the changes

Step Two

We need to make sure that your computer is clean from the infection. If a healthy USB stick gets corrupted after being used on your computer, that a sign that the virus is running on your system and your antivirus is not doing it’s job. Use the update function  your Antivirus. If the antivirus still fails to catch the infection even after the update, you definitely need to use another product.

—————————————————————–

October 2013 Update

Some users are reporting that no matter what they did, the virus kept running. Reader Grafik Krime has contributed with the following instructions:

For those still having issues and it and cannot stop it:

1.    Open Task Manager (Ctrl+Alt+Del) and End Process for any WSCRIPT.EXE that is currently running. (This will stop the running virus, the next steps are for preventing it from running again next time you start your computer)

2.    Click on Start

3.    Type REGEDIT and Tap Enter

4.    Click on HKEY_CURRENT_USER

5.    Click on Software\

6.    Click on Microsoft\

7.    Click on Windows\

8.    Click on CurrentVersion\

9.    Click on Run.

10.  On the list on the right find any reference to a file that ends with  .vbs and take note of were that .vbs file is located

11.  Go to the said location and delete the .vbs file

12.  Go back to Regedit and delete the key referencing thtat said .vbs  file

Thank you very much Grafik Krime!

—————————————————————–

June 2013 Update

Some users are reporting that their current Antivirus brand was unable to detect and eliminate the infection. I like the products from Avira, Kaspersky and Dr.WEB. The first one offers a Free version, the others offer 30 day trials.

But please STOP: Before start uninstalling and installing things, follow this whole guide in order to test if your current Antivirus get rid of the infection.

Also to avoid incompatibilities and system problems Do NOT install more than one (1) antivirus program on a single computer.

—————————————————————–

Step Three

If everything went fine at this step you should be able to see “new” files in your USB drive. The formerly hidden files probably are your missing files and folders. The shortcuts  on the other hand were created by the infection and are not related with your files.

Proceed to delete the shortcuts, the Autorun.inf, any .vbs file and everything you don’t recognize as yours. Needless to say, be careful, do not delete your legit files!

Step Four

To permanently change the properties of your files back to normal we need to open the Command Prompt.On Windows Vista and 7:

·         Click on Start

·         Type cmd in the first box you see

·         Press ENTER

On Windows XP:

·         Click on Start

·         Click on Run

·         Type cmd

·         Press ENTER

Step Five

On the black Window that appears -technically called the Command prompt- write the commands shown on the picture. Don’t forget to replace the letter X with the letter of your infected drive.

For example, if your affected drive letter is F then the command should be attrib -h -r -s /s /d F:\*.*

After writing the command hit enter and wait a few seconds while the changes are made.

Done!

Go back to the file explorer and see if the file attributes are back to normal.

Now that your issue is solved, why you don’t relax for a while checking the other sections of this site?

First off, please go to Start, type in services.msc in the search field, and press ENTER.

In the list of Services that comes up, right click - ‘Interactive Services’ from the list. Select ‘Stop’. Now, right click on that service again - select Properties. In ‘Startup type’ select ‘Disable’. Click “OK”.