How to Remove Shortcut Virus in PC and Flash Drive

Windows batch script to unhide files hidden by virus

Since I'm seing many people having their files hidden by flash drive viruses, I'm giving them a Windows command line using attrib (or using Linux) to solve the problem when the infected files are removed and the their files are still "missing". The command removing file and folders properties system, hidden and arquive (not really needed): attrib -s -h -a /s /d :\*.* Does anyone know a how to make a script to prompt the user for the drive letter or folder? I've already seen some software that does something like this but I think this would be better. thx! [Solved] Solved using Cheeso's code as base @ECHO OFF ECHO "Enter Drive letter" set /p letter= attrib -s -h -a /s /d %letter%:*.* [Improved a bit] @ECHO OFF ECHO Type the drive letter. ONLY the letter. ECHO ALL FILES ARE GOING TO BE MODIFIED!!! set /p letter= ECHO %letter%: selected taskkill /im explorer.exe /f ECHO. ECHO "Modifying files..." ECHO. attrib -s -h -a /s /d %letter%:\*.* ECHO "Process completed." start explorer %letter%: taskkill /im cmd.exe /f windows batch-file hidden I.C. Tiempo  December 19, 2014  How to Remove Shortcut Virus Ultimate Guide How to remove shortcut virus? I receive so many complaints about this shortcut virus. How it affects every precious file that we value the most. If your file is infected by it, it will be hidden and inaccessible until at some point that it becomes corrupted and unusable. Not good, right? In response to that, I created this ultimate guide on how to remove shortcut virus and other important things that you need to know about this virus. To make you aware about it and be able to protect your devices against it. So let’s start with its types… Recommended reading: 7 Signs of Virus infected flashrive Types Shortcut virus has two variations; the most common is Flash drive Shortcut virus, then the File and Folder Shortcut virus. File and Folder Shortcut Virus This shortcut virus replicates your files and folders, hide and replace it with shortcuts.exe. This is a combination of Trojan and Worm. The bad thing about this shortcut virus, it will leave you no options but to click it in order to open your files and folders. Then after executing it, the virus starts to duplicate itself and install malicious software that monitors your computing habit and worst, steal your important data and credit card information. Flash Drive Shortcut Virus This is purely Trojan; it consolidates every file in your portable devices and put it into one hidden folder. Then, it creates a Flash Disk shortcut.exe. Like the file and a folder shortcut virus, it will give you no choices but to click it to see your files. Once executed, it installs malicious applications that spy your computing routine and most probably steal your financial records if not detected. First Aide Unfortunately, not all antivirus can detect shortcut virus. So, the best thing you can do, is to make-it-a-habit not to open your portable devices or hard drive via autorun or from “my computer”. Here’s the complete Shortcut virus First Aide to do lists; Do not open your Flash Drive via autorun and from My Computer. Open your Flash Drive and Hard Disk by right-clicking it, then click explore or type  its drive letter in the windows address bar to prevent any script from running. Follow the instruction here how to unhide Files hidden by the virus, to see the real files which are hidden by shortcut virus and to avoid executing it. The above steps are designed to prevent shortcut virus from infecting your computer. It will also help you distinguish the real file from the virus-made files. As what I have said earlier, even prominent antivirus failed to catch shortcut virus. Nonetheless, I will be sharing you 3 methods to remove it, follow the guide below; How to remove shortcut virus using shortcut virus remover tools – Method 1? Download these two tools, namely: Trojorm Removal Tool and Shortcut virus fixfolder, click here. Now, after downloading the shortcut virus remover tools above, extract it using winrar or any other file decompressor. Then run the “Trojorm Removal tool” first, make sure that you run it inside your flash drive, wait until the scan is complete and press enter. Next, copy the Shortcut Virus fix folder, paste it inside your flash drive or external drive. Then, open it via right-click, choose “open with” and select “notepad”. Look for the H:, change it according to your Flash Drive’s letter (ex. E:, F:, G: and so on).   When you are done editing, save it. Now double click the vbs file or open it via right-click, choose “Windows Based Script Host”. . .after running the script, shortcut virus must be gone and your files are now visible. How to remove Shortcut virus using command prompt/CMD? – Method 2 You should  proceed this method if the first one doesn’t work. This involves a “command prompt”. Now click “start”, “run”, “type cmd” “type the drive letter of your flash drive or external hardisk and a colon after it “eg F:” Once done type this attribute “attrib f:*.* /d /s -h -r -s”. You should see your files now and Shortcut Virus must be removed. Please take note the f: after the attrib, change it with your flash disk drive letter; if your flash drive, drive letter is e: then change it with e:. Video Tutorial This Shortcut virus removal video tutorial, is an answer to all emails, requesting me to make a video tutorial of this post. It will be the best solution for those who are fond or more comfortable on video tutorial. In this tutorial also, you will learn the two types of shortcut virus. It is all in one Shortcut Virus removal How-to.  Shortcut Virus Remover Finally, if you followed the two methods above and still you see the shortcuts,  use this shortcut virus remover to remove those shortcuts remnants. Download: HFV HFV Hidden Folder Virus is my favorite shortcut virus remover. It is easy to use and you don’t need to install it in your system because it works as a standalone application. If run in the first time, it will prompt you to enter your desired password. HFV can disinfect and remove shortcut virus both from internal and portable devices. To clean your Hard Drive, Folder, Files or Portable device just simply click the “ADD” or “BROWSE”, select the desired drive, folder or file, then choose the “Delete Virus” after that click  “Unhide Files” to recover your files. That’s how easy HFV removes shortcut virus. How to prevent shortcut virus from coming back? Install HFV or SmadAV as your primary defense and a good antivirus plus it with Malwarebytes to complete your solid protection. Your comments and suggestions are highly appreciated to improve this How to Remove Shortcut Virus Tutorial. Speak up your mind in the comment box below. How To Remove Pendrive Shortcut Virus From Your USB Drive And Computer With each new version of Windows, Microsoft is making it harder for hackers and crackers to hack into Windows. Windows has also become less vulnerable to viruses and other malware by default as Microsoft has added securities like a built-in antivirus program and blocking removable media auto run functionality until selects to do so etc. But most people still fall prey to USB viruses because they attack automatically when a USB drive is inserted and auto-run is turned on. The best way to avoid viruses and keep yourself safe is to educate yourself about how computers work and how to keep it secure. In this article, we will go through the solution to completely remove pendrive shortcut virus from our USB drive and our Windows computer. Symptoms and behavior of Pendrive shortcut virus Lately I have been asked about the pen drive shortcut virus by quite a few people including users of iTechtics through the comments on other articles. The symptom of this virus is that all the folders you copy to your USB drive will be converted to shortcuts. If you double click the shortcut, it will open the same folder in a new window. At first I didn’t take it serious until I came across an infected system myself. If you go to Google Search and search for a solution to pen drive shortcut virus, you will be greeted with a lot of pages with almost the same sort of solution. A batch file is being shared across all the pages that I came across. The batch file simply does three things; unhide all the files in the USB drive, delete all the shortcuts in the USB drive and delete two files called fypuas.exe and fypuasx.exe. While this is a solution, it is not a permanent solution as it will only last until the computer is restarted. If you restart your computer and insert your USB drive again, it will show the same behavior as discussed above. Fixing Pendrive shortcut virus issue permanently Before going through the steps to delete this virus from your system, let me give you a brief overview of what this virus does. This will make it easier for us to understand and solve the problem. This virus surfaced in 2010 and has been around with different names since then. It injects itself to system startup, creates a few executable files inside the USB drive which look like shortcuts, hides the original folders and files inside the USB drive, copies itself into the profile folder of the current user and connects to an outside computer. If you right click any shortcut folder inside your USB drive and go to Properties, you will be able to confirm that this is actually not a shortcut but properties of an executable file. Now let’s go through removing the shortcut virus step by step: Download Hijackthis and install it on your computer. Scan your computer with Hijackthis and preferably save the log file. Hijackthis gives your a list of entries with codes at the start of each line. Each code has a meaning. We need to look at the entries with code ’04’. These are the entries which are executed when a user is logged into the computer. These entries will display startup items for all the users in the computer. Make sure you delete all entries which have the following file names inside them: fypuas.exe and fypuasx.exe Now open your Task Manager. Under Processes, make sure no process is running under the name fypuas.exe and fypuasx.exe Now go to your profile home folder (Run –> %HOMEPATH%), delete all files named fypuas.exe and fypuasx.exe Hopefully the above steps will cleanup our system from the pendrive shortcut virus. Now let’s clean our USB drives and restore our data. Open command prompt (Run –> cmd) and go to your USB drive. For example, if my USB drive is E drive, I’ll need to type E: and hit the enter key. This will take me to the USB drive inside the command prompt. Run the following command: del *.lnk This will delete all files with the extension of a shortcut Now run the following command: attrib -h -r -s /s /d E:*.* This command will remove the following attributes from all files inside the USB drive; hidden, read-only, system. Following these steps should remove the virus from the USB drive completely. If you open your USB drive folder from Windows Explorer, you will be able to see all your files and folders restored inside the USB drive. After removing this virus, you should scan your system with a good antivirus so that it may be able to detect and remove traces of any virus inside your computer. You will be able to download AVG Internet Security 2014 free for one year. If you are still having problems with this malware even after going through all these steps, please let me know through comments and we can find a solution to your specific problem together.