According to the developers of antivirus programs, a new type of virus has long been wandering around from a USB flash drive to a USB flash drive and over the network. The fact of infection is immediately obvious - all directories on the flash drive become invisible or turn into shortcuts.
This is an "autoran" virus
First of all, check your computer for viruses. With a normal security status report, open the flash drive in the total commander and find all untitled directories. Enter the files stored in such directories and change the attributes - remove all four checkboxes and click "ok". Make sure there are no more hidden files on the flash drive.
Next, you need to see what each of the visible shortcuts launches. As a rule, they initiate the launch of the same file on the same drive. Check the properties of the shortcut. In case of infection, a double launch will be detected - the first opens the directory, the second launches the virus program. In the line "Object" you can see the path to the virus, usually something like "11dc09d81.exe" in the Recycle directory on this flash drive. Delete it along with the directory.
Recovering file views
Remove all directory shortcuts. The directory icons are transparent - this means that the virus downloader has marked these directories as system and hidden. To disable these attributes, use a command line reset.
Click the "Start" button, select the "Run" command. Enter the CMD command and press ENTER. In the command prompt window, enter the commands: cd / d f: / press ENTER, where f: / is the designation of the drive (flash drive); attrib -s -h / d / s press ENTER - this command will remove the attributes and the directories will become visible.
Alternatively, you can create a text file directly on the USB stick. Enter the command attrib -s -h / d / s in the file, rename it to 1.bat and run. The command execution can take quite a long time depending on the number of files. After that, you can return the original view of the folders, that is, hide the system hidden files.
How to check if a computer is carrying a virus?
If there is a suspicion that this computer is spreading a virus through USB drives, then you can refer to the list of processes in the task manager. To do this, start the dispatcher and check the registry for a current process named XSd8USB7858.
Keep in mind that the source of this process cannot be removed by AviraAntivir, DrWeb CureIT, Kaspersky Removal Tool. That is, your task is to find the anti-virus utility that can remove this source. This is the driver defined with Autoruns.
For further virus protection, you can create a directory called Autorun.inf. The meaning of this is that it is impossible to create a file with a name that has already been assigned to the directory.
