2

I am having difficulty with my laptop right now. All of a sudden some partitions would contain a link to the previous contents of that partition. For example:

Before:
Partition T:\
            \somefile1
            \somefile2
            \somefile3

Now:
Partition T:\
            \autorun.inf
            \Partition T: . lnk
            \<random>.FAT (hidden)
            \desktop.ini (hidden)
            \(other hidden files)

The link file is a shortcut to the previous contents of the partition. Not only that, some of my folders (along with the files inside it) have gone missing. I suspect it's a virus but AVG and AVAST doesn't detect a thing (actually some Metasploit files but I know it's false positive) other than windows 7 loader extreme edition (w7lxe.exe). I recently installed a desktop theme, though, which had a explorer.exe and shell with it. Any suggestions? (file recovery's already solved)

And another, whenever I try to delete the autorun.inf file, It says, "Could not delete autorun.inf because it is open in Windows Update", when in fact my Windows Update is disabled.

============================ EDIT ==========================================

I forgot to mention: The .lnk shortcut is linked to 'rundll32.exe' and opens the null-named folder that contained the original content of the partition.

2

2 Answers 2

1

First open the command prompt ,cd to particular partition and run this

attrib -s -h /s /d *

Then you need to open that partition using windows explorer. You must not double click on hard disk. Use left pane and navigate to particular partition.

Then delete all other files in your hard disk that you do not need. Do same for C drive.

If you can not delete some files

Start -> run

type 'msconfig' and enter

Stop all services and restart and do the all above steps.

Finally you need to edit your registry. follow below steps

  1. go to run
  2. type regedit.
  3. go that path:- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\Hidden\SHOWALL 4.Look at the CheckedValue key( in right side).This should be a DWORD key. If it isn't, delete the key. Create a new key called "CheckedValue" as a DWORD (hexadecimal) with a value of 1.

Restart your machine... This should work.

FYI

start -> run gpedit.msc

And TurnOff Autoplay for all devices. This will help you to protect from viruses.

And do not double click on hard disks. Always try to use explorer

1
  • +1 Although this does not solve the problem but rather prevents it from happening again. Mar 14, 2013 at 12:21
0

I recently installed a desktop theme, though, which had a explorer.exe and shell with it.

It doesn't sound like a virus only. It could also be a very badly coded theme.

The problem is (most likely), this theme was coded for a different operating system, or a different service pack version, or a before/after a specific update.

Installing it on a system with different updates or service packs would lead to incompatibility issues, and since this theme is updating some core windows system files, it looks like it broke windows.

In cases like this, the only way to be sure you got rid of it is to re-install windows.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .