"My removable device" shortcut virus..

Anonymous

When I plug my USB on my computer, a virus hides my files and creates a shortcut called "My removable device".

If I check shortcut's properties it shows this path "C:\windows\system32\rundll32.exe ~$WV.FAT32,_ldr@16 desktop.ini RET TLS " ".

I ran AVG Antivirus and it found the following:

Trojan horse Deflier.G

Windows/SysWOW64/svchost.exe

and it deleted it.

I format my usb, then I re-insert the USB and the shortcut is there.. again.

If I run a "show usb" program, it shows me the hidden files, there are

desktop.ini

thumbs.db

autorun,ini

~$WOSFVR.FAT32

a folder with no name where all my files were relocated by the virus

and the evil shortcut.

please help.

[Moved from Windows]

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Hi Carlos,

Welcome to Microsoft Community and thanks for posting the question.

Based on the description provided, it looks like you are facing an issue while connecting USB to the computer.

It would be great if you could answer these questions in order to assist you further.

1. Is the issue confined while connecting any particular USB?

2. Have you made any changes to the computer prior to this issue?

I would suggest you to try the following methods and check.

Method 1:

I would suggest you to run the Microsoft Safety Scanner and check if there is any virus.

Microsoft Safety Scanner: http://www.microsoft.com/security/scanner/en-us/default.aspx

Note: The Microsoft Safety Scanner expires 10 days after being downloaded. To rerun a scan with the latest anti-malware definitions, download and run the Microsoft Safety Scanner again. Any data files that are infected may be cleaned by deleting the file entirely, which means there is a potential for data loss.

Method 2:

I would suggest you to Remove and reinstall all USB controllers.

To remove and reinstall all USB controllers, follow these steps:

a) Click Start, click Run, type sysdm.cpl in the Open box, and then click OK.

b) Click the Hardware tab.

c) Click the Device Manager button.

d) Expand Universal Serial Bus controllers.

e) Right-click every device under the Universal Serial Bus controllers node, and then click Uninstall to remove them one at a time.

f) Restart the computer, and then reinstall the USB controllers.

g) Plug in the removable USB storage device, and then test to make sure that the issue is resolved.

Keep us posted on the status of the issue.

If you need any other information about Windows, feel free to post your questions and we will be glad to help.

0 comments

66 additional answers

Anonymous

2013-03-01T09:13:05+00:00

Hi. I'm experiencing the same kind of problem as Carlos.

I've already received reports from a lot of my friends that their fingerdrives have been "infected" by this some sort of shortcut virus. My EHD has been infected too.

I'm going to try Method 1 in a bit and see if it works. Thanks, Vijin.
Was this answer helpful?

0 comments No comments
Anonymous

2013-03-02T05:35:09+00:00

PROBLEM SOLVED: USB - Shortcut link (is it a virus?)

CUT your files from the shortcut link (the virus) and PASTE it on your original USB STORAGE device (on the same place where the shortcut was). Delete that shortcut link, safety remove the usb, and restart your computer. Then reinsert the usb. The link doesn't show up again. :p weeeeeeee
Was this answer helpful?

0 comments No comments
Anonymous

2013-03-03T00:02:00+00:00

Good Day Vijin V, i tried your shared ways to remove this freaking virus but it is still there. I think the infected one now is my unit not my memory stick.

http://dl.dropbox.com/u/23171967/1.png ------- this is my memory stick after doing the cmd mode using "***attrib -h -r -s /s /d g:\.* " it did'nt work and i scanned it using Microsoft Safety Scanner but nothing is detected.****Any further help?
Was this answer helpful?

0 comments No comments
Anonymous

2013-03-03T09:14:50+00:00

I did what you said but problem still exists.

I'll add a little bit more information to Carlos H.Raygoza post because I have exactly the same problem:

When I open my USB drive (this is SanDisk Cruzer 4GB) in Windows Explorer (Windows 7) I can see only "My Removable Device (4GB)" shortcut icon, even if I "check" to show me hidden files and folders in Windows. This shortcut as Carlos said has this very odd path:

C:\Windows\system32\rundll32.exe ~$WO.FAT32,_rev@16 desktop.ini R3T TLS " "

It nevertheless opens my main USB space with files looking untouched whatsoever.

But when I use some program like 7-Zip File Manager and open this drive from it I see a bunch of hidden files:

-"System Volume Information" folder

-unnamed folder which store all my USB drive files (that supposed to be on main G:\ location)

-empty "autorun.ini"

-"desktop.ini" which have odd content inside (screenshot: http://i.imgur.com/870HXeA.png)

-"My Removable Device (4GB).lnk" file

-"Thumbs.db"

-"~$WO.FAT32"

I tried many things. My updated Norton 360 doesn't alert me about any viruses. But every time I try to remove all that junk files and put all my content to main location (which is G:) and then unplug my device and plug it again the problem comes back and it looks the same - all files are moved to empty folder, shortcut is created with all other files I mentioned.

I tried twice to format my drive... nothing helps.

PS. Sorry for my english - I hope everything I wrote is understandable.
Was this answer helpful?

0 comments No comments