Have you ever met this kind of wired situation? All your files and folders suddenly became shortcuts when you connect the removable media (say a USB flash drive, an external hard drive, or a SD memory card, etc.) to your computer and you try to access data in it.
The files and folders are supposed to be in size of MBs (Megabytes) or GBs (Gigabytes), but it just shows 1KB or 2KB if you check the property. You also tried the removable media in a different PC, same problem. So, what happened? How to make the file folders show up as usual? How to recover the files if they are gone at all?
In this post, I'm going to show you the possible reasons, and step by step fixes (most likely, it's a quick fix).
What are the causes?
You probably have guessed it. Yes, it's the virus or Trojans (like BUOUFO, QWERT etc) or autorun.inf worm. Your removable storage device should have been caught by them, the moment you connected your device to the infected computer. As a result, all the files and folders become "hidden". Sometimes you can make them visible again simply by switching to non-hidden mode, but sometimes that wouldn't work and eventually you have to kill those viruses or Trojans.
Continue to read...for step by step fixes below.
How to Fix Folder Become Shortcuts Problem?
To start with, do not format the removable media immediately. Because formatting will make the data insides much harder to be recovered, and the operation won't necessarily kill the virus. Also, sometimes it won't allow you format the device by showing not formatted error. For example the autorun.inf worm can stop a flash drive from being formatted.
Follow the right steps here:
Step 1: Check whether the files are in hidden mode.
- Click on "Start" > Run > type cmd and click OK.
- Here, I assume your removable drive shows as G: Enter this command: attrib -h -r -s /s /d g:\*.* (replace the letter g with your the right letter your "removable drive" showed under "My Computer" or "This PC" if you're under Windows 10).
- Now check your original files and folders. Are they normal?
Step 2: Scan and remove malware.
If you have installed a security software on your computer, open it and have a thorough scan. If not, here are some tools to check PC health.
Make sure you use the Full Scan mode of an antivirus or anti-malware. Because usually the default option is Quick Scan. This way you should be able to kill those problem makers. After that, see if the file folders can be accessed normally.
No luck? Go to step 3.
Step 3: Format your storage device and retrieve the data with a recovery tool.
Normally, you should be able to format it under Windows with its built-in quick format option. Read this article if you don't how to do that. If that method doesn't work, you may need to use a third-party formatting tool to format your drive. Check out this SanDisk support post for more.
After formatting, you should be able to re-use your removable drive again. But, if you have important data saved in the disk, try to retrieve the data using Recuva (Pandora Recovery works too). Both programs are completely free to use without any function restrictions.
Do you find this fix guide helpful? Share your opinions in the comments below.
oh man i can't thank you enough! i thought i lost over 1.5tb of data on my external HD. thank you thank you, it worked perfectly!
ReplyDeleteTom
Hi, Tom. Glad to hear that it helped. Cheers!
ReplyDeleteI know this might be a old post but oh my word i'm telling you work like a charm, I mean i said that I lost my files and every thing cames as short cuts. i copy and paste the htnl in the cmd and boom all my files showed back up with a short cut mark wow oh wow men a million thanks to you sir. I'm going now see if that will work for my pics now lol!
DeleteThanks a tonne...You r really a saviour
ReplyDeletethanx ........works so heavenly fine...the shortcuts almost gave me a heart attack
ReplyDeleteThank You!
ReplyDeleteTHANK YOU SO VERY MUCHHHHHHH.............. :) :)
ReplyDeletehow to type the command?why i cant type the command? it shows the command is not recognize !
ReplyDelete@Anonymous this command is like this: attrib -h -r -s /s /d g:\*.* And you should replace the letter 'g 'with your the "removable drive" letter showed under "My Computer". Is that clear?
ReplyDeleteexactly....
DeleteHI! i was the one who post the comment on 15 June!
ReplyDeletei face the problem before! but i formatted the Usb! then now i just want to know how to solve it!
i plugged in my usb wothout the problem, the i type the command , the error command came out!
the : attrib -h -r -s /s /d g:\*.*
the -h -r -s need to space? or just type without any spaces?
please help me! thanks!
@ my reader who left a comment on June 15th. Well, you need to space between the letters. But I am afraid that is not the point to solve the problem because you have formatted the USB drive. When you format a drive, all your files will be gone (though not so permanently). My suggestion to your case is: simply bypass #1 (command line check) and go to #2 (use the anti-virus to find and kill the virus if possible). Then if you have important data in the usb, use the data recovery software I recommended in #3. Hope this helps. Regards
ReplyDeletethanks! :)
ReplyDeletejune 15th
i did the first step nothing happened... then i went for the second but i didn't get the desired result however it did scanned files inside the folders which means the files r there somewhere... can u help me out?? does that mean that i hav to use the third step??
ReplyDelete@ my blog reader who left a message on June 17th. When you perform step 2, what anti-virus program are you running? Did it find and kill the virus or Trojan? Let me know please. You can try the following based on your situation.
ReplyDeleteIf the virus was found and killed but your files or folders still won’t turn out, yes go to #3 and use the data recovery program a try please. If data recovery tools won’t help, format the drive and re-use the recovery tool again to see if the files can be recovered. (note: data recovery programs won’t do any damage to your drive, it just scan the drive for lost files and won’t write any data to it, so take it easy)
If the virus wasn’t cleaned, use another anti-virus (there are so many ones on the market, it won’t be hard for you to find a good one) and re-scan the drive to clean the virus.
thanks and grt it works fine, again thanks a lot.
ReplyDeleteGOOD STUFF!! worked perfectly!! thank you!!
ReplyDeleteThanks alot yaar,
ReplyDeleteit works perfectly, thank you.
it turns out, even with the installation of the recommended antimalware from cnet, the folders are still shortcuts and it seems the virus is now affecting my computer as well. this doesnt work.
ReplyDeletei installed the antimalware, ran the scan of the external drive, deleted threats and when i check the folders on the external drive, viola, still shortcuts. i hope i am doing something wrong.
ReplyDeletep.s. should i be using an antivirus with this antimalware software? i believe the virus has caused google chrome to crash.
i posted june 15 @ 5:22 & 5:46. THIS IS RIDICULOUS! NOW MY WHOLE SYSTEM IS INFECTED I UNINSTALLED THE ANTIMALWARE TO INSTALL AVG v9(ANTIVIRUS) and the virus is blocking it (saying that the file giupiux.exe-which is one of the viruses-cant be found, whenever i run the avg exe file. THIS IS UNBELIEVEABLE!!!!!! SYSTEM (OS WNDWS7)SEARCH DOESNT SHOW MY PROGRAMS INSTALLED ON MY LAPTOP HARD DRIVE. SIMPLY STEMMING FROM FINDIND A FIX FOR FOLDERS THT HAVE BECOME SHORTCUTS, MY WHOLE LAPTOP SYSTEM IS WRECKED!!!!!!!
ReplyDeletethanks!!! it really works!!!
ReplyDeletethis worked perfectly and restored my files on my USB, and hopefully will do the same on my external hard drive. One thing that isnt clear is whether it gets rid of the virus or just makes my folders accessible? I had previously run my USB throught a virus scan and it said it got rid of the virus but I still saw it on the USB. After doing this, there was a RECYCLER and a RECYLERW files on the USB. (The RECYCLERW wasn't there before...)
ReplyDeleteThere is a kind of virus called RECYCLER.exe. But it should have been cleaned out by the anti-virus program in your case. No need to worry about it. Simply delete the file manually. Learn more about the virus from http://www.frihost.com/forums/vt-88563.html
ReplyDeletei have windows 7...how do i get to the "start > run > type cmd" part? i can't even find "run"....
ReplyDeleteTo My Blog Reader who left a message on June 30th.
ReplyDeleteUnder Windows 7 you can use shortcut "⊞Win+R" to run it. Note: the "⊞Win" is right between "fn"and "alt".
this was very helpful...thanks a lot!!!
ReplyDeleteThanks a ton dear !!!!
ReplyDeleteI could't recover my files from external hard drive.Please help me.I have 98gb files in my hard drive.First i hv started from the 1st step.That was not worked well. then i have formatted my external hard drive still the same problem...please help me.I am out of mind.
ReplyDeleteTONS OF THANKS!!!
ReplyDelete@ the reader who left a comment on July 9. Step 1 is not the key point. You should try Step 2 and try clean the virus if possible. Formatting your external drive is not the best option. Regards.
ReplyDeleteThanks john,me only left the comment on 9th.But now i formatted my hard drive.please tell some solution to recover files from formatted hard drive.I have tried so many things but i could't recover still.What i want to do now.Is it possible to recover files from formatted hard drive or not.
ReplyDeleteMegha, I guess you should have performed a quick format. No need to worry that much as you have much chances to recover the lost files. Speaking from technical view a quick or complete format won't be necessary to erase the data immediately untill they are overwritten. So now what you need to do is install a data recovery freeware (in STEP 3) such as Pandora Recovery or Recuva etc to see if you can harvest. Regards
ReplyDeleteJohn, Pandara and recuva not recovering my formatted data.I have tried so many softwares like pandora, Recuva, EASUS, but none of the programs can find formatted files from the drive. Any other suggestions to get back the data? Thanks
ReplyDeleteJohn,can you please save my ex-hardisk?
ReplyDeleteI already do the 2nd step a few time and it found a lot of virus...after that the folder inside my ex-hardisk is still the same "shortcuts".
Please! I'm begging you~~
From:HaseYo
HaseYo, You can give the following steps a try.
ReplyDelete1.Use some other anti-virus programs to scan your external disk (there are many free and powerful ones out there). According to what you described, it seems that the device is badly affected so cleaning the problem makers should be urgent.
2.If still the folder is “shorcuts”, try format your hard disk (note: use quick-format way). But before you do this, if you have some valuable data insides, grab a data recovery program to recover first.
3. After formatting the drive, the virus should be gone and you can continue to use the device again. Note: quick format won't be necessary to erase data permanently, re-use the data recovery software to see if you can have some harvest.
i ran the first step and it is showing access denied and then i ran the 2nd one deleting all the virus.....but still it is same....plz help me i've more than 1tb data in it....what should i do now
ReplyDeleteHi John,
ReplyDeleteThanks for the tips!
After the first step and scanning for the trojan do I manually delete each shortcut?
oh and does this virus/infection only affect removable drives or will it infect my hard drive also?
Thanks!
hey john thanks for the help! I scanned my removable disk and pretty much cleaned it. But was wondering what does attrib -h -r -s /s /d g:\*.* actually do except reveals all the hidden folders and files?
ReplyDeleteThanks again!
Thank you very much John, very much helpful my sister inlaw is very glad that the files s he needed so badly can be opened, thank you
ReplyDeletethanks this was great help but how do i remove the virus
ReplyDeleteGreat help! Thank you so much!
ReplyDeletefinally i got it done aft trying it for hours!!! thks so much!!! u r my savior!!!
ReplyDeletemich9532
It worked! All my files reappeared on my HD, however all the shortcuts and RECYCLER file are still on my HD.
ReplyDeleteI tried to delete RECYCLER (like suggested above), but it won't let me.
It says: "Access is denied. Make sure the disk is not full or write-protected and that the file is not currently in use"
Any suggestion?
@ my blog reader who commented on July 25. You don't have to delete it, let it be there as won't do anything bad. Learn more here, http://www.computing.net/answers/windows-vista/can-not-delete-recycler/5810.html
ReplyDeletethx for the command. as for the shortcut's you can remove them wit nod32 trial version :)
ReplyDeleteThx for help.
This didn't worked for me.. The Anti Malware did it's thing but the virus is still there.. They're still the same pseudo-folder.. (a .exe application with a folder thumbnail..)
ReplyDelete-Tony21
Thanks a lot friend u helped in recovering my wife's medical report .
ReplyDeletewish u a best of luck
thanks once again
Dear John,these steps didnt work forme. my hd problem is not the short cut the entire data itself. no files are hidden. when i run a scan i can see the software scanning through the folders. when i check the size through my computer it shows 115 gb but when i open the external hard disk and check it shows only 700 mb. kindly help
ReplyDeleteWow cool ^^ thank you so much
ReplyDeleteIt really works
thanks dude!....
ReplyDeleteHey there
ReplyDeleteI'm just wondering, after doing step #1 and the files show up, do I still need to do the step #2, or do I need to manually delete the virus?
Thanks,
Gids
thanks...
ReplyDeleteI almost give up hope on my 250gb hard drive. i thought i can never retrieve my files.
thanks anywayz....
kiraaquddin maakelode pehle kaiku nai bola???thanks
ReplyDeleteHi , John Zhang , This topic is so helpful , but for some reason ... after i use freeware Malwarebytes Anti-Malware to scan my whole external harddrive and restart my pc the virus will reappear in my external harddrive, i scan it like 3 times but still there ! Do u have any idea how to completely remove them ? I am so helpless now :(
ReplyDeleteTo my blog reader who left a message on Sep 4. Maybe the virus is too stubborn. Take a try some other anti-virus and see if they can be cleaned. see here, http://data-security-freeware.blogspot.com/2011/07/free-anti-virus-or-anti-spyware.html
ReplyDeleteThanks a lot....:)
ReplyDeleteWith your suggestion I have got back my files back but still their is one more problem..the shortcut keys are still visible..so my question is..will deleting these shortcut keys do any harm again..??
No, it won't. Once the virus was cleaned, everything will be OK then. You can delete it or not. But don't forget the most important thing: Backup! Backup! Avoid same suffering happening again. Regards
ReplyDeleteThank you very much dear, everythings back to normal...uh! Cheers... ;)
ReplyDeleteHello,
ReplyDeleteI am called Moses Olaki here in Juba, South Sudan. Thanks a lot for your help. I was able to recover all the shortcut folder documents by following the procedure you above. May God bless u. Good day.
thank u so much dude, it helped me a lot.... Got all ma songs back to normal
ReplyDeletehi...i followed step 2, downloaded the antimalwarebyte..but it shows no threat but my pendrive still has lots of shortcuts and i lost my 3 GB documents...
ReplyDeletehi John, i went all the way to file recovery,at last im so happy to see my file found, but i need to pay 69 USD to save the file...i thought it is free on trial pack?plz help!
ReplyDeleteI was expecting or you may say that was guessing that this happened due to virus but was not sure when I faced same situation.Your solution solved the issue.Thanks
ReplyDeleteHey man I just made all the steps and it dosen't went back to normal but when I open the shortcut it says that the iteam kzjuy.scr was moved or delted.
ReplyDeleteand it asks to delete the shortcut do I delet it??
thanx for the input it really has helped me out. now kinda showing of at the office. i suspect one of the pc's is the source of the virus and this particular pc has no Ethernet control drivers i have downloaded all the drivers i could for the DX2300 hp still no result i was hoping to upgrade to windows 7 but the issue is i run a database on it and the drivers for a card reader will be compromised.
ReplyDeleteTHANK YOU SO MUCH!!!!!!!!
ReplyDeleteThis is the best solution ever!! Fast and easy, I will bookmark this site for future reference, Thank you very much for this, it made my day, night and most likely my hole week. :)
ReplyDeletethank u so much for helping me
ReplyDelete'dstar
I was successful in removing the virus, but now all of the shortcuts are gone and I can't see my files. When I search for them, they do appear. As further proof that they are still there, my external hd still reads the same amount of memory as before. However, I can't see my files.
ReplyDeleteThanks a bunch.
ReplyDeleteThis has helped me twice. :)
Great.. this was very helpful. Solved my issued from the first step. thanks.
ReplyDeletethanks a tonnnn.....
ReplyDeleteThe program is asking me to give a serial code :( What to do about it?
ReplyDeleteYa it works and the original folder appear as well as short cut folder after using step 1, and i want to know that should i delete the short cut folder or not Plz advise.....
ReplyDelete@Kursheb,how did you get pass the registration thing? :(
ReplyDeletethanks dude! :)
ReplyDeleteOMGGGG THANK YOU SOOO MUCH, it almost made me wanna kill the hard drive. THX
ReplyDeleteUm, so i didn't format my pendrive, and i tried step one, it shows my original folders along with a windrvs32.exe ( i'm suspecting that's the virus) and for a few seconds the file will still be there, but later they are automatically deleted or something. What should i do?
ReplyDeleteI can't thank you enough !!! thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you thank you .......
ReplyDeleteMy cmd command did nothing as we had this problem on our mapped drives from our server, we have virus's on the server but we are cleaning them off... how do we restore the folders from being hidden and appearing as shortcuts?
ReplyDeleteHi,
ReplyDeleteThank you so much..it worked..you saved my life. Great help!!!!God bless you!!
Thank you..
ReplyDeleteThank you very much...
ReplyDeleteIts work!
Thank you for the useful article.. It works!!!!!!!!!!! happy mode
ReplyDeletethankyou very much
ReplyDeleteThumbs UUUUUUUUUUUPPPPPPPPPPPPP
You are god mate ty a lot work like a charm !!
ReplyDeleteThnx!!!!!
ReplyDeletethanks a lot!!!!
ReplyDeleteattrib -h -r -s /s /d g:\*.* shows up access denied to my HD drive...What now??
ReplyDeletethank you so much you saved my very imp. data ...
ReplyDeletegod bless you ....:)
hi the command worked but after ejecting the external hd and connecting it again, i'm back to problem number 1: all files are in shortcut again. do i have to run the command every time i connect my external hd? help.
ReplyDeletemy kaspersky antivirus is showing that they are unprocessed file.........
ReplyDeletewhat to do,
shortcut is created and i have lost my important files
Awesome .... It worked fine for me ... thanks a ton :)
ReplyDeleteThank you so much kind sir! Worked a treat for me :)
ReplyDeletesuper thumbs up!!!!thanks a lot:) i just recovered my old photos and video files!love ur hub thanks again!!!:)))
ReplyDeleteMy hard drive will not run any .exe files. They are all still there but i cannot open them. All the microsoft programs say application not found. I ran malwarebyte, everything was clean, but it only took 7 seconds for the scan. HELP me, Please!
ReplyDeleteThank you so much!! My files are recovered!
ReplyDeletethank you very much!
ReplyDeleteyou saved my mobile phone! ;)
thanks!!! a LOT !! you are a great help!
ReplyDeletemannnn... i cant thank you enough.. cheers mate..100% works!!
ReplyDeletewhat is the anti virus to kill RECYCLE this virus?
ReplyDeletethank you so much!!
ReplyDeleteThank you sir, it works for me :)
ReplyDeleteI still have this problem and Have been trying for three days to kill the virus or worm my externals are still not changing and I have a million photos on them ,
ReplyDeleteScrewed Photographer
thanks, it really works.....its very easy too...
ReplyDeletethank you so much.. it really works..
ReplyDeleteeuhm..
ReplyDeletei have tried to enter the command:
attrib -h -r -s /s /d Removeable_Disk: \*.*
but it didn't work, "Parameter format not correct"
need help please...
if i enter
ReplyDeleteattrib -h -r -s/s /d Removeable_Disk:\*.*
"Invalid switch - -s/s"
space between -s /s not -s/s great help it worked!
ReplyDeleteTHANK YOUUUUUUUU SOOOOOOOOOOOOOOOOOOOOO MUCHHHHH!!!
ReplyDeleteThank you sooooooooooo much !!! U are great man !!!
ReplyDeletethe command worked perfectly !! thank you so much :)
ReplyDeleteOMG Thanku Thanku........:-*
ReplyDeletedude it is showing as access denied
ReplyDeleteOH MY GOD, AFTER SEARCHING FOR 10 HOURS I FINALLY GOT THIS HINT WORK FOR ME, BOTH OF MY HARRDISC RECOVERED.
ReplyDeleteTHANK YOU VERY MUCHHHHHHH.
THANK YOUUUUU
THANK YOUUUUU
THANK YOUUUUU
THANK YOUUUUU
Wow! You're great! This is really really helping! Thank you very much Mr Zhang. I thought my files couldn't be retrieved...
ReplyDeletethanks so much brod!you save my files!wowowowow!
ReplyDeleteYayyy ! After all this time , I finally fix my files ;D
ReplyDeleteThank you so much for this (:
nice bro....
ReplyDeleteoh GOSH!! I cant Thank You enough!!!
ReplyDeleteGod Bless U!!
Thanks a lot this saved my sister graduation project
ReplyDeleteit worked even i'm using windows 7. Thank so much!
ReplyDeleteits work TQVM
ReplyDeleteDude you are the bomb, you just saved my behind mehn. Thanks a lot.
ReplyDeletegod bless you man
ReplyDeletethank you very much dear keep going
ReplyDeleteThank you, thank YOU very much.
ReplyDeleteyour tips have saved all my datas and once more i thanked you very much.
regards
tshering
BHUTAN
Thank you very much, step #1 worked like a charm!
ReplyDeleteGreetings from Norway
this information saved my grad thesis from being lost forever. thank god for people like you! really appreciate you posting this
ReplyDeleteBundle of thanks
ReplyDeleteReally its an amazingly works
Thanks again
Iftikhar from Pakistan
Hi,
ReplyDeleteI typed in attrib -h -r -s/s /d g:\*.*
and then it said Invalid switch - -s/s /d but when I went to check my shortcut folders they were all gone!!! so beofre I was seeing the folders and now I can't even see them, thank you in advance for your help!
Thank you very much...it fix my external Hard Disk folders.
ReplyDeletejust clean c can solve the problem. You can open these shortcut like folders and file by changing the target from properties. If the file or folder is "image" and your drive is I , just change the target from that lengthy script to I:/image . Then open it. That's all.
ReplyDeleteAfter completing step #1 it gives me the desired result. Thank you very much JZ for this post. It works great.
ReplyDeleteattrib -h -r -s /s /d f:\*.* what is NEXT when itype it?
ReplyDeleteThank you very, very much!!! You're an angel! I nearly had a heart attack thinking my files are lost!
ReplyDeleteWhen ever your folders in flash drive convert into short cuts of 2KB it means you have trojan or some exie virus in your flash drive you can resolve the issue as..
ReplyDelete1.First attach the flash with your computer
2.Open you flash as..
double click on my computer
then your flash drive will appear in My computer don't double click on you flash drive directly..jut click on folder in my coputer's menue bar you will see each drive path in a side window then click only once on your flash drive. it fill open but not show your original folder
4. now delete short cuts of your folder it will not harm your original data
5.now check the properties of your flash drive in my computer and scan it with updated antivirus software.
eject your flash drive apter scanning.
(don't worry if your flash do not showing your data after scanning.. now you should follow following method
i.Open My computer
ii. click on Tool in menu bar
iii.click on folder option and Folder Option window will appear now
iv. click on View and now select " Show hidden files and folders
vi. also de active the tow options first " Hide extension for known files" and second "Hide protected operating system files (Recommended)
after removing correct mark in these tow options now click apply ....
and you fill find your hidden folder now you can copy your data of these hidden folders in any hard drive of your personal computer ... after copying now formate your flash drive now you can copy your data again in flash dive and it will be safe in all respects..
Imran Hnif Research Scholar.. email me in case of any problem shazal350@yahoo.com
Thank you very much dear. You saved me from nervous breakdown. I was very much worried, that i lost all my old pics dating back to year 2003, some 5000 pics in all.
ReplyDeletewhen i typed in cmd which you mentioned it showed me as
ReplyDeleteAccess denied - G:\c43f705036d0b113913fa8c5d8\amd64
Access denied - G:\c43f705036d0b113913fa8c5d8\i386
Access denied - G:\System Volume Information
please help me :(
thank u so much~~ u save my life~~~ hihihihihi~ all my precious data is in the external hardisk~~
ReplyDeleteIt works perfectly!! I'm so grateful that I found this guide because it really works and it helps!! Words are not enough to say how much I appreciate this guide..A million, billion thanks...I saved my files esp. my photos..Thank you and Advance Happy Holidays to everyone. May God bless and protect us always...
ReplyDeleteThanks man!!
ReplyDeleteYou are a life saver!!! Thank you soo much. Its important for everyone to know the exact letter of their USB drive, also make sure you type it in accurately and pay attention to the spaces between letters and symbols!!!
ReplyDeletethanks.............i recovered my files
ReplyDeletehey
ReplyDeleteonce i plug in my usb for my ipod, it keeps saying format and i have tried everything including the command prompt and its not working...Help
i typed in attrib -h -r -s/s/d d:\*.* and it said patch not found -D:\
ReplyDeletemjay007, your case is different. Does Windows say "the drive is not formatted, do you want to format now" or similar? If yes, please turn to this blog post for how to fix the problem. Merry Christmas!
ReplyDeletewhen i type -h -r -s /s /d g:\*.* and enter, it says " '-h' is not recognized as an internal or external command, operable program or batch file"
ReplyDeletemy hard disk is format for PS3 (FAT32)
thanks a lot mr.JZ....it workd correctly.....done a good job........
ReplyDeleteI tried what you have posted here unfortunately the command did not run. I have tried a vbscript to remove the shortcuts and restore the files and it was restored. Here is the script you might want to try:
ReplyDeleteSource: http://www.computing.net/answers/security/my-folder-is-become-shortcuthow-to-restore/32651.html
'A Vbscript To restore your Original Folders in your PenDrive and delete the infected shortcuts
Just Copy and paste this code in your Notepad and save it as ShortcutRemover.vbs
Dim MsgTitre,fso,Ws,NomFichierLog,NBfichier
MsgTitre="Les Raccourcis Infectés dans le Flash © Hackoo"
Set fso = CreateObject("Scripting.FileSystemObject")
Set Ws = CreateObject("Wscript.Shell")
Set dc = fso.Drives
For Each d in dc
If d.IsReady and d.DriveType = 1 Then
racine = d.Driveletter
MsgBox "Votre Lecteur Flash est le " &racine&":\",64,MsgTitre
end if
Next
Ws.Run "%comspec% /c attrib -s -h -r "&racine&":\*.* /D /S",0,True
Ws.Run "%comspec% /c dir "&racine&":\ > Resultat.txt",0,True
MsgBox "Voir le Contenu du FlashDisk",64,MsgTitre
Ws.Run "Resultat.txt"
NomFichierLog = "LOGFILE.txt"
Set OutPut = fso.CreateTextFile(NomFichierLog,1)
Set folder = fso.getFolder(""&racine&":\")
If fso.fileExists (""&racine&":\rtlip.exe") Then
fso.DeleteFile ""&racine&":\rtlip.exe",True
OutPut.WriteLine " le Virus rtlip.exe à été Supprimé avec Succés !"
else
OutPut.WriteLine " le Virus rtlip.exe n'est pas contenu dans le FlashDisk !"
end if
If fso.fileExists (""&racine&":\x.exe") Then
fso.DeleteFile ""&racine&":\x.exe",True
OutPut.WriteLine " le Virus x.exe à été Supprimé avec Succés !"
else
OutPut.WriteLine " le Virus x.exe n'est pas contenu dans le FlashDisk !"
end if
If fso.fileExists (""&racine&":\ert.dll") Then
fso.DeleteFile ""&racine&":\ert.dll",True
OutPut.WriteLine " le Virus ert.dll à été Supprimé avec Succés !"
else
OutPut.WriteLine " le Virus ert.dll n'est pas contenu dans le FlashDisk !"
end if
NBfichier=0
For Each Fichier in folder.Files
If UCase(FSO.GetExtensionName(Fichier.Path)) = "LNK" Then
NBfichier=NBfichier+1
OutPut.WriteLine Fichier.Path
fso.DeleteFile(Fichier)
end if
Next
MsgBox NBfichier& " Fichiers Raccourcis Infectés Contenu dans le FlashDisk ont été supprimés avec Succés ! ",64,MsgTitre
OutPut.WriteLine vbNewLine & NBfichier& " Fichiers Raccourcis Infectés ont été supprimés ! © Hackoo"
Explorer(NomFichierLog)
Explorer ""&racine&":"
Function Explorer(File)
Set ws=CreateObject("wscript.shell")
ws.run "Explorer "& File & "\"
end Function
thank you very much!!!!!!
ReplyDeleteThank u friend good work
ReplyDeleteam so grateful. it worked like magic. thanks so much. you guys rock.
ReplyDeleteMr. JZ (John Zhang) My problem is i have a memory card which cannot be opened and cannot be formatted. And im afraid to lose the files if i format it. So i want a solution that will make the removable disk accessible. I already did the disk management thing but it says no media. And i already changed the letter but it wont solve my problem. Hoping to get solutions ASAP. Thanks a lot.
ReplyDeleteThank you so much. I don't have any word. Its like a miracle to me. In my usb drive, my lovely son photo, my last one year data, so much thinks are there. Through you help, I am able to recover the folders and data. Good Luck.
ReplyDeleteI just don't understand what to do I tried the cmd...ok attrib -h -r- s /s /d g:*.* but nothing happened a lot of data was coming up saying access denied. Please help....its my external hard drive with virus and its driving me crazy!!
ReplyDeletewhat about my computer ? the virus is gone from my Flash drive... but when my friend plugged in his, it got infected
ReplyDeleteworked great thank u so much
ReplyDeleteThese step worked. Just existed one apps file name 'vpeu'. Can i delete the file
ReplyDeleteI have a problem with my files in my flash disk.
ReplyDeleteI created a 3 different folder in the same day..
lets say folder1. folder2 and folder3...I put the appropriate files for each folder.like in folder 3.. i created another folder3.1 inside of it and 3 additional jpeg file.
on the next day i open my flash disk..and I tried to open folder3 then open folder3.1 but unfortunately, when i open the folder 3.1 its like opening again the folder3...i cant even open the jpeg file inside of it...i try folder 1 & 2..but still the files and folder inside it is same as in folder 3...but still cant open, if I will open folder3.1 it will just do the same, and same....could anyone help on this..pls..
thanks
thank u very very much for helping me
ReplyDeleteBless you dude :-))
ReplyDeletethanks a lot man. YOU ARE GOD!!!
ReplyDeletethnx a l0t! it really worked! but how to remove the virus from our computer?
ReplyDeleteSo... what happens when this was the issue on my PC that crashed, and I've replaced it with a new Mac running Lion? All my files on my external hard drive now show as .lnk extensions when I connect to my Mac. Is there any way for me to recover them directly to the Mac, or do I need to use a friend's PC for the fix outlined above and then migrate my files to the PC some other way? Thanks in advance.
ReplyDeleteOMG. This actually solved my problem. Thanks man.
ReplyDeletethanx Dear. It worked!
ReplyDeletethan you John
ReplyDeleteI did that and now there's NOTHING on my USB.wtf???? please help,does this mean its all deleted??
ReplyDeleteThanks so much!! Got all my pics back from this New years! :) :)
ReplyDeleteGuys Try the SHORTCUT VIRUS REMOVER.. it worked for me...
ReplyDeletejust trying to help guys.
you can download this tiny software here:
http://www.fileserve.com/file/3JhPRTt
i hope it will work for you guys...
i tried the #1 step (attrib -h -r -s /s /d e:\*.*) but nothing happens.. here's the message when i'm clicking the folder
ReplyDelete"The item 'nbdijx.exe' that this shortcut refers to has been changed or removed, so that shortcut will no longer work properly"
Do you want to delete this shortcut?
hope to hear from you the soonest..
thanks
ArJey
thank you man :)
ReplyDeletethank you buddy,i did not format it so the first step worked for me,thanks again.
ReplyDeletethanks.. this is a great help.. -sandz
ReplyDeletethank you!
ReplyDeleteTHank you this...reallllllllly helped...but as m learning programming myself I am curious what is " attrib -h -r -s /s /d g:\*.* "this command doing,plzzz can you explain like what is 'attrib' doing...' -h'..'-r'...n all what are they doing.. do reply
ReplyDeletethe attrib command is used in DOS to change the attributes of a file, it is used with these letters
Delete+r/-r enables/disables "read-only" attrib of a file
+s/-s enables/disables "system" attrib of a file
+h/-s enables/disables "hide" attrib of a file
+a/-a enables/disables "archive" attrib of a file
it is like right-clicking on a file and checking the boxes to hide/unhide, etc. properties of that file.
like:
attrib +h (filename.extension) to hide the folder you specify when you are inside that folder.
hope this works for you, i'm not a profesional, it's just how i remember from school :D
i tried the command but i guess since my external hard drive was from an old laptop i had months ago it says access denied
ReplyDeletehello.. i got this virus from my brother's computer... i thought i lost all the folders (it's the only thing it affected) they appeared to become like shortcuts... i unplugged my usb memory, plugged into my laptop and AVG detected it right-a-way!! it got rid of the virus (so it said). i deleted the RECYCLE folder (show hidden files is enabled on explorer) and scanned again with 0 threads. deleted the shorcuts but i still couldn't see the folders, openned CMD and couldn't see them either with the DIR command. i typed CD (directory) and the directory and files were there, but i wasn't able to see them in the usb. so i used the attrib command like the one you posted here, and everything went back to "normal" my compter doesn't seem to have that problem again. THANK YOU!!!
ReplyDeletethanks.. you helped me alot.. you saved my files..
ReplyDeleteIts working. Tx so much my man!
ReplyDeletewhen i input the command i get acesss denied recycle....
ReplyDeleteThank you so much.It is helping me a lots~!!!
ReplyDeleteThank you very much!!!!!!
ReplyDeleteFinally someone knows what they talking about!! This worked awesomely Thank you!! this info needs to get out there cuz it was hard to find after, 5 hours of nonsense I came across this and forgot all about the attrib commands
ReplyDeletethank you so much! it helps a lot!
ReplyDeleteits very helpful many thanks
ReplyDeleteDudee that was soo helpful!! I thought i lost 1 tb of stuff...cant thank you enough....
ReplyDeleteOMG Thank you very much you are a genious!!!
ReplyDeleteyes sir you are a GENIUS! Salutes :D
ReplyDeletewhat if my files are back but the shortcuts aren't gone yet?
ReplyDeleteThank you oh gosh thank you very much!! No one could help me with my problem but your tip worked perfectly. :D Kudos to you sir!
ReplyDeleteThanks mate..I try this on my External Hard Disc..and it's work..I have scan my External HD with many antivirus, still wont work..But using your tips help me solve my hard disc problem..Thank you very much mate..Really helpful!!
ReplyDeleteHi;
ReplyDeletethe attrib command couldn't work with me, it stated
"access denied, \$recycle bin"
pls help me..
thanks so much!!! you're so great! :D
ReplyDeleteTHANKS SO MUCH....ITS WORKING
ReplyDeletenot working for me.... :(
ReplyDeleteThis is Surya! Thank you very much the I attempt attrib command works for me great
ReplyDeletethank you very much