Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am having difficulty with my laptop right now. All of a sudden some partitions would contain a link to the previous contents of that partition. For example:

Before:
Partition T:\
            \somefile1
            \somefile2
            \somefile3

Now:
Partition T:\
            \autorun.inf
            \Partition T: . lnk
            \<random>.FAT (hidden)
            \desktop.ini (hidden)
            \(other hidden files)

The link file is a shortcut to the previous contents of the partition. Not only that, some of my folders (along with the files inside it) have gone missing. I suspect it's a virus but AVG and AVAST doesn't detect a thing (actually some Metasploit files but I know it's false positive) other than windows 7 loader extreme edition (w7lxe.exe). I recently installed a desktop theme, though, which had a explorer.exe and shell with it. Any suggestions? (file recovery's already solved)

And another, whenever I try to delete the autorun.inf file, It says, "Could not delete autorun.inf because it is open in Windows Update", when in fact my Windows Update is disabled.

============================ EDIT ==========================================

I forgot to mention: The .lnk shortcut is linked to 'rundll32.exe' and opens the null-named folder that contained the original content of the partition.

share|improve this question
2  
You seem to be surprised that your anti-virus might be inneffective - while it's not clear if there is a virus or not, you might want to read these: imperva.com/docs/… carbonblack.com/… dsd.gov.au/infosec/top-mitigations/… –  symcbean Mar 14 '13 at 9:42
    
Everything seems back to normal, for now. I just ran the AVG command line in safe mode and deleted the pesky files and autorun.inf –  Mywiki Witwiki Mar 14 '13 at 12:20
add comment

2 Answers 2

I recently installed a desktop theme, though, which had a explorer.exe and shell with it.

It doesn't sound like a virus only. It could also be a very badly coded theme.

The problem is (most likely), this theme was coded for a different operating system, or a different service pack version, or a before/after a specific update.

Installing it on a system with different updates or service packs would lead to incompatibility issues, and since this theme is updating some core windows system files, it looks like it broke windows.

In cases like this, the only way to be sure you got rid of it is to re-install windows.

share|improve this answer
add comment

First open the command prompt ,cd to particular partition and run this

attrib -s -h /s /d *

Then you need to open that partition using windows explorer. You must not double click on hard disk. Use left pane and navigate to particular partition.

Then delete all other files in your hard disk that you do not need. Do same for C drive.

If you can not delete some files

Start -> run

type 'msconfig' and enter

Stop all services and restart and do the all above steps.

Finally you need to edit your registry. follow below steps

  1. go to run
  2. type regedit.
  3. go that path:- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ Advanced\Folder\Hidden\SHOWALL 4.Look at the CheckedValue key( in right side).This should be a DWORD key. If it isn't, delete the key. Create a new key called "CheckedValue" as a DWORD (hexadecimal) with a value of 1.

Restart your machine... This should work.

FYI

start -> run gpedit.msc

And TurnOff Autoplay for all devices. This will help you to protect from viruses.

And do not double click on hard disks. Always try to use explorer

share|improve this answer
    
+1 Although this does not solve the problem but rather prevents it from happening again. –  Mywiki Witwiki Mar 14 '13 at 12:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.