Step One
Windows has the bad habit of hiding certain files and their extensions. This may be useful to avoid confusing novice users, but presents serious drawbacks. You may, for example, run a dangerous program like “photo.jpg.exe”because Windows only shows the “photo.jpg” portion. For that reason, and also to help fighting t...his memory stick infection, you need to make all files visible. The following steps apply for Windows XP, Vista and 7.
Click on Start
Click on Control Panel
Pick Folder Options
>Click on “View” tab
Clear the following check boxes:
Clear the check box “Hide protected operating system files (Recommended)”
Clear the check box “Hide extensions for known file types”
Click Accept to apply the changes
Step Two
We need to make sure that your computer is clean from the infection. If a healthy USB stick gets corrupted after being used on your computer, that a sign that the virus is running on your system and your antivirus is not doing it’s job. Use the update function your Antivirus. If the antivirus still fails to catch the infection even after the update, you definitely need to use another product.
October 2013 Update
Some users are reporting that no matter what they did, the virus kept running. Reader Grafik Krime has contributed with the following instructions:
For those still having issues and it and cannot stop it:
Open Task Manager (Ctrl+Alt+Del) and End Process for any WSCRIPT.EXE that is currently running. (This will stop the running virus, the next steps are for preventing it from running again next time you start your computer)
Click on Start
Type REGEDIT and Tap Enter
Click on HKEY_CURRENT_USER
Click on Software\
Click on Microsoft\
Click on Windows\
Click on CurrentVersion\
Click on Run.
On the list on the right find any reference to a file that ends with .vbs and take note of were that .vbs file is located
Go to the said location and delete the .vbs file
Go back to Regedit and delete the key referencing thtat said .vbs file
Thank you very much Grafik Krime!
June 2013 Update
Some users are reporting that their current Antivirus brand was unable to detect and eliminate the infection. I like the products from Avira, Kaspersky and Dr.WEB. The first one offers a Free version, the others offer 30 day trials.
But please STOP: Before start uninstalling and installing things, follow this whole guide in order to test if your current Antivirus get rid of the infection.
Also to avoid incompatibilities and system problems Do NOT install more than one (1) antivirus program on a single computer.
—————————————————————–
Step Three
If everything went fine at this step you should be able to see “new” files in your USB drive. The formerly hidden files probably are your missing files and folders. The shortcuts on the other hand were created by the infection and are not related with your files.
Proceed to delete the shortcuts, the Autorun.inf, any .vbs file and everything you don’t recognize as yours. Needless to say, be careful, do not delete your legit file
Step Four
To permanently change the properties of your files back to normal we need to open the Command Prompt.On Windows Vista and 7:
Click on Start
Type cmd in the first box you see
Press ENTER
On Windows XP:
Click on Start
Click on Run
Type cmd
Press ENTER
Step Five
On the black Window that appears -technically called the Command prompt- write the commands shown on the picture. Don’t forget to replace the letter X with the letter of your infected drive.
For example, if your affected drive letter is F then the command should be attrib -h -r -s /s /d F:\*.*
After writing the command hit enter and wait a few seconds while the changes are made.
Done!
Go back to the file explorer and see if the file attributes are back to normal.
Now that your issue is solved, why you don’t relax for a while checking the other sections of this blog?
Windows has the bad habit of hiding certain files and their extensions. This may be useful to avoid confusing novice users, but presents serious drawbacks. You may, for example, run a dangerous program like “photo.jpg.exe”because Windows only shows the “photo.jpg” portion. For that reason, and also to help fighting t...his memory stick infection, you need to make all files visible. The following steps apply for Windows XP, Vista and 7.
Click on Start
Click on Control Panel
Pick Folder Options
>Click on “View” tab
Clear the following check boxes:
Clear the check box “Hide protected operating system files (Recommended)”
Clear the check box “Hide extensions for known file types”
Click Accept to apply the changes
Step Two
We need to make sure that your computer is clean from the infection. If a healthy USB stick gets corrupted after being used on your computer, that a sign that the virus is running on your system and your antivirus is not doing it’s job. Use the update function your Antivirus. If the antivirus still fails to catch the infection even after the update, you definitely need to use another product.
October 2013 Update
Some users are reporting that no matter what they did, the virus kept running. Reader Grafik Krime has contributed with the following instructions:
For those still having issues and it and cannot stop it:
Open Task Manager (Ctrl+Alt+Del) and End Process for any WSCRIPT.EXE that is currently running. (This will stop the running virus, the next steps are for preventing it from running again next time you start your computer)
Click on Start
Type REGEDIT and Tap Enter
Click on HKEY_CURRENT_USER
Click on Software\
Click on Microsoft\
Click on Windows\
Click on CurrentVersion\
Click on Run.
On the list on the right find any reference to a file that ends with .vbs and take note of were that .vbs file is located
Go to the said location and delete the .vbs file
Go back to Regedit and delete the key referencing thtat said .vbs file
Thank you very much Grafik Krime!
June 2013 Update
Some users are reporting that their current Antivirus brand was unable to detect and eliminate the infection. I like the products from Avira, Kaspersky and Dr.WEB. The first one offers a Free version, the others offer 30 day trials.
But please STOP: Before start uninstalling and installing things, follow this whole guide in order to test if your current Antivirus get rid of the infection.
Also to avoid incompatibilities and system problems Do NOT install more than one (1) antivirus program on a single computer.
—————————————————————–
Step Three
If everything went fine at this step you should be able to see “new” files in your USB drive. The formerly hidden files probably are your missing files and folders. The shortcuts on the other hand were created by the infection and are not related with your files.
Proceed to delete the shortcuts, the Autorun.inf, any .vbs file and everything you don’t recognize as yours. Needless to say, be careful, do not delete your legit file
Step Four
To permanently change the properties of your files back to normal we need to open the Command Prompt.On Windows Vista and 7:
Click on Start
Type cmd in the first box you see
Press ENTER
On Windows XP:
Click on Start
Click on Run
Type cmd
Press ENTER
Step Five
On the black Window that appears -technically called the Command prompt- write the commands shown on the picture. Don’t forget to replace the letter X with the letter of your infected drive.
For example, if your affected drive letter is F then the command should be attrib -h -r -s /s /d F:\*.*
After writing the command hit enter and wait a few seconds while the changes are made.
Done!
Go back to the file explorer and see if the file attributes are back to normal.
Now that your issue is solved, why you don’t relax for a while checking the other sections of this blog?
