Virus in the external Hard disk

[deep1234]

Hi guys, I have a external hard disk that is infected with a viruses. What it did, it had changed all the folders on it to the look of the shortcut and when ever you click on one it give you "rthul.scr" not found. But if you navigate to the folder name, it is working properly.

What I did, I scanned it with Avast 5.0 free it did found 15 threads but didn't fixed the shortcut issue. I am thinking of testing it with different AV like Avira to see what are the results.

Note: I can do the folders manually but total size of the files are around 350GB!!! which will take a lot of time.

Kindly advice me what to do and thank you.

[deep1234]

No replay yet :(.

Update: I scanned it with Antivir Free edition but it didn't detect anything extra. And the problem still there, looks like I have to do it the hard way.

[Knife Party]

boot from a linux environment and try to backup the data. then format drive if you really want to be a 100% sure

[Detection]

I would run Malwarebytes Anti-Malware on the drive

Sounds like it has changed all your shortcuts to point to the virus, so I would delete them

The fact it is saying "rthul.scr" not found, tells me you have successfully deleted at least that virus, but a virus scanner can not repair shortcuts, just delete them, and make them again

[Steven P. Administrators]

A quick Google search and I found this: http://www.prevx.com/filenames/158330643667532011-X1/RTHUL.EXE.html

Maybe that helps?

[giantpotato]

An antivirus isn't going to undo changes made by the virus. It's only going to remove the virus itself, and it sounds like this is already done.

[deep1234]

I believe I didn't explain this properly. What I meant was, all the folders had been changed by the virus to shortcuts with the folders name but pointing to the virus (the is no more visible folders any more other than the shortcuts). The virus had been removed now, but what I am looking now is how to make the shortcuts back to folders in an automated way, for ~350GB it wont be easy.

[Rudy]

I believe I didn't explain this properly. What I meant was, all the folders had been changed by the virus to shortcuts with the folders name but pointing to the virus (the is no more visible folders any more other than the shortcuts). The virus had been removed now, but what I am looking now is how to make the shortcuts back to folders in an automated way, for ~350GB it wont be easy.

It might have already deleted all that information

[deep1234]

No they are still their if I navigate to the folder name.

[TEX4S]

In the future, maybe quit relying on the freebies

[HoodiBoY]

Try this one..

1.Install 'USB disk security' and scan your External Hard disk

2.If it show all the folder shortcuts as suspicious.

3.Remove all of them

4.Download a small tool called 'USB show' from Internet and recover all your folders.

or you can directly try step 4 if you are sure that virus has been cleaned.

[Japlabot]

Tick "Show hidden files" and Untick "Hide Protected Operating System Files" in the folder options, then do a file search for desktop.ini on the external hard disk, delete all the desktop.ini files and then you should be right to go.

[deep1234]

Tick "Show hidden files" and Untick "Hide Protected Operating System Files" in the folder options, then do a file search for desktop.ini on the external hard disk, delete all the desktop.ini files and then you should be right to go.

Your way did work thanks a lot. But worried about deleting desktop.ini (I don't have info about this), is there any risk on the actual data of that this file is located in? And if I delete it the folder will return to normal?

[Eric Veteran]

Your way did work thanks a lot. But worried about deleting desktop.ini (I don't have info about this), is there any risk on the actual data of that this file is located in? And if I delete it the folder will return to normal?

No, it won't affect the data in the folders. The "desktop.ini" files only store view information about the folders like whether it should show thumbnails, etc.

[deep1234]

Done with deleting "desktop.ini" but still the Folders are hidden and in the attributes I can't uncheck this as it is disabled. It is the only last thing, and I am done with it.

[Japlabot]

Done with deleting "desktop.ini" but still the Folders are hidden and in the attributes I can't uncheck this as it is disabled. It is the only last thing, and I am done with it.

Right click on the External Drive in my computer and go to Properties, untick "Hidden" (it may be a shaded out box, indicating that some things inside are hidden and some are not), then click OK. When prompted, choose the option to apply to the folder, subfolders and files and click OK.

if that doesn't work, go into Command Prompt (Start > Run > cmd [enter]) and type in:

attrib -a -s -r -h Z: /S /D

Where Z: is the drive letter of your External Drive.