"My removable device" shortcut virus..

Anonymous
2013-02-25T20:21:23+00:00

When I plug my USB on my computer, a virus hides my files and creates a shortcut called "My removable device".

If I check shortcut's properties it shows this path "C:\windows\system32\rundll32.exe ~$WV.FAT32,_ldr@16 desktop.ini RET TLS " ".

I ran AVG Antivirus and it found the following:

Trojan horse Deflier.G

Windows/SysWOW64/svchost.exe

and it deleted it.

I format my usb, then I re-insert the USB and the shortcut is there.. again.

If I run a "show usb" program, it shows me the hidden files, there are

desktop.ini

thumbs.db

autorun,ini

~$WOSFVR.FAT32

a folder with no name where all my files were relocated by the virus

and the evil shortcut.

please help.

[Moved from Windows]

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2013-02-26T11:24:04+00:00

Hi Carlos,

Welcome to Microsoft Community and thanks for posting the question.

Based on the description provided, it looks like you are facing an issue while connecting USB to the computer.

It would be great if you could answer these questions in order to assist you further.

1.       Is the issue confined while connecting any particular USB?

2.       Have you made any changes to the computer prior to this issue?

I would suggest you to try the following methods and check.

Method 1:

I would suggest you to run the Microsoft Safety Scanner and check if there is any virus.

Microsoft Safety Scanner:  http://www.microsoft.com/security/scanner/en-us/default.aspx

Note: The Microsoft Safety Scanner expires 10 days after being downloaded. To rerun a scan with the latest anti-malware definitions, download and run the Microsoft Safety Scanner again. Any data files that are infected may be cleaned by deleting the file entirely, which means there is a potential for data loss.

 Method 2:

I would suggest you to Remove and reinstall all USB controllers.

To remove and reinstall all USB controllers, follow these steps:

a)    Click Start, click Run, type sysdm.cpl in the Open box, and then click OK.

b)    Click the Hardware tab.

c)     Click the Device Manager button.

d)    Expand Universal Serial Bus controllers.

e)    Right-click every device under the Universal Serial Bus controllers node, and then click Uninstall to remove them one at a time.

f)     Restart the computer, and then reinstall the USB controllers.

g)    Plug in the removable USB storage device, and then test to make sure that the issue is resolved.

Keep us posted on the status of the issue.

If you need any other information about Windows, feel free to post your questions and we will be glad to help.

Was this answer helpful?

4 people found this answer helpful.
0 comments

66 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2013-07-14T11:28:16+00:00

    Hi everyone!

    The virus infects the RUNDLL32.EXE file. Following steps to remove the virus from your flash:

    1. open RUN box by pressing Winlogo+R
    2. type cmd and press enter.
    3. type the letter of the infected flash drive with ":" (e.g. G: ) and press enter.
    4. type "attrib -s -h -r *.* /s /d" and press enter (without quotes"
    5. Wait until the next line appears, now type del *.inf
    6. type del *.db
    7. type del *.lnk
    8. open your flash and go inside the unnamed folder and cut all of your files (but desktop.ini) and paste them into the flash root.

    Note: Delete the unnamed folder.

    To remove virus from your computer you need to replace the infected rundll32.exe file with new one. You can download the new file from here: http://s3.picofile.com/file/7728995799/rundll32.exe.html

    Then run your windows in safe mode. After the windows desktop appears, run cmd as administrator. type takeown /f rundll32.exe and press enter.

    Go to following path: %windir%\system32\

    right click on rundll32 and click on properties.

    click on Security Tab then click on edit button.

    click on Users and tick the checkbox Full control.

    Click ok and ok !

    now paste the NEW file in system32 folder and replace it with the old version.

    Restart Computer and enjoy!!!

    Please notify me about the results!!! :D its messing me like **** my friend, my rundll32 is not allowing me to set full control and overwrite withe the downlooaded one, am using windows 7 home premium. please help me

    Was this answer helpful?

    0 comments
  2. Anonymous
    2013-07-09T17:02:39+00:00

    Was this answer helpful?

    0 comments
  3. Anonymous
    2013-07-03T07:14:59+00:00

    not working. When i try to select the usb drive, i get this error:

    error: attempt to index global 'd_info' (a nil value)

    Stack Traceback:

    1:[Page1 -> xButton1-> On Click] Line: 8 in main chunk

    2:[Page1 -> On Show] Line: 1 in main chunk

    My dear friend, Gicafarafrica79,

    thanks for downloading and informing me about the result of using.

    This error occurs because the first action of the page. You should click on ok and close the error dialog and then try to select the USB, if the usb not found you have to run the application as Administrator and then try again.

    Contact me on facebook:

    <PII Removed>

    Was this answer helpful?

    0 comments
  4. Anonymous
    2013-07-02T15:41:10+00:00

    not working. When i try to select the usb drive, i get this error:

    error: attempt to index global 'd_info' (a nil value)

    Stack Traceback:

    1:[Page1 -> xButton1-> On Click] Line: 8 in main chunk

    2:[Page1 -> On Show] Line: 1 in main chunk

    Was this answer helpful?

    0 comments