"My removable device" shortcut virus..

Anonymous

When I plug my USB on my computer, a virus hides my files and creates a shortcut called "My removable device".

If I check shortcut's properties it shows this path "C:\windows\system32\rundll32.exe ~$WV.FAT32,_ldr@16 desktop.ini RET TLS " ".

I ran AVG Antivirus and it found the following:

Trojan horse Deflier.G

Windows/SysWOW64/svchost.exe

and it deleted it.

I format my usb, then I re-insert the USB and the shortcut is there.. again.

If I run a "show usb" program, it shows me the hidden files, there are

desktop.ini

thumbs.db

autorun,ini

~$WOSFVR.FAT32

a folder with no name where all my files were relocated by the virus

and the evil shortcut.

please help.

[Moved from Windows]

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Hi Carlos,

Welcome to Microsoft Community and thanks for posting the question.

Based on the description provided, it looks like you are facing an issue while connecting USB to the computer.

It would be great if you could answer these questions in order to assist you further.

1. Is the issue confined while connecting any particular USB?

2. Have you made any changes to the computer prior to this issue?

I would suggest you to try the following methods and check.

Method 1:

I would suggest you to run the Microsoft Safety Scanner and check if there is any virus.

Microsoft Safety Scanner: http://www.microsoft.com/security/scanner/en-us/default.aspx

Note: The Microsoft Safety Scanner expires 10 days after being downloaded. To rerun a scan with the latest anti-malware definitions, download and run the Microsoft Safety Scanner again. Any data files that are infected may be cleaned by deleting the file entirely, which means there is a potential for data loss.

Method 2:

I would suggest you to Remove and reinstall all USB controllers.

To remove and reinstall all USB controllers, follow these steps:

a) Click Start, click Run, type sysdm.cpl in the Open box, and then click OK.

b) Click the Hardware tab.

c) Click the Device Manager button.

d) Expand Universal Serial Bus controllers.

e) Right-click every device under the Universal Serial Bus controllers node, and then click Uninstall to remove them one at a time.

f) Restart the computer, and then reinstall the USB controllers.

g) Plug in the removable USB storage device, and then test to make sure that the issue is resolved.

Keep us posted on the status of the issue.

If you need any other information about Windows, feel free to post your questions and we will be glad to help.

0 comments

66 additional answers

Anonymous

2013-06-09T08:06:01+00:00

Hello

got same problem

I tried solution, but when apply " del *.inf" I get error "process can't access file beacuse beign used by another process"

So, which process should I stop for deleting files....

Also, I tried a different solution..... used a ubuntu linux cd... then enter usb and delete .inf, .lnk and .nil files.... it worked for the usb stick, but this can't remove the virus from windows rundll32.exe

Please advice

Thanks

Hi, I've to say that your second solution is the best way for cleaning the USB flash but about rundll32.exe...

Did you change the file permission (as I explained)?

In order to change the rundll32.exe with new one you HAVE to change the permission of file.
Was this answer helpful?

0 comments No comments
Anonymous

2013-06-09T00:46:53+00:00

Follow this

http://blog.piratelufi.com/2013/02/usb-flash-drive-contents-replaced-with-a-single-shortcut/

works very nice!!
Was this answer helpful?

0 comments No comments
Anonymous

2013-06-08T21:21:33+00:00

Hello

got same problem

I tried solution, but when apply " del *.inf" I get error "process can't access file beacuse beign used by another process"

So, which process should I stop for deleting files....

Also, I tried a different solution..... used a ubuntu linux cd... then enter usb and delete .inf, .lnk and .nil files.... it worked for the usb stick, but this can't remove the virus from windows rundll32.exe

Please advice

Thanks
Was this answer helpful?

0 comments No comments
Anonymous

2013-06-08T08:09:18+00:00

Dear Microsoft,

Im running Windows 8 64 bit and I think I got my laptop infected by this virus. I already tried the two methods you suggested but still, every time I put a USB on my laptop it gets infected by this annoying virus! Please resolve this problem and provide us with instructions.

BTW, just to add some more info, whenever I try to open the file location of the shortcut created by the virus, it redirects me to rundll32.exe. But if I click on open, then it redirects me to the contents of my USB.I hope you guys can come up with a solution since it has already spread to other PCs in our office

Hi Dear NDSMendoza,

Did you read my answer?

I've explained that if you change the rundll32.exe with new one then the virus will never back again...

sorry for ENGLISH!!! :D
Was this answer helpful?

0 comments No comments