How does the virus work?
The program runs with an autorun file that starts once a deveice (USB flash hard drive) is inserted into a computer. The virus is dependent upon the autorun system of the computer; this however also serves a it’s weakness. Antivus programs have the capability to block the autorun file as the device is inserted. This prevents the virus from running and infecting other files within your computer.
If infected, the virus then replicates your files and hides your original files replacing them with a shortcut - not to your files but to the virus itself. This action serves as it’s backup plan encase the autorun system fails. The original files are not damaged, only the attributes had been changed.
How to show hidden files?
It is most likely that your file(s) attribute’s had been changed into system file. In this case, ticking the “show hidden files” option will not be enough. Here’s a simple step to show your hidden files.
- In windows explorer go to, Tools > Folder options > View (tab)
- Click on the “show hidden files” and uncheck the “Hide protected operating system files (recommended)”, a warning will pop up, click yes. Then apply changes.
You will now able to see your original files but in a very dull color indicating that it used to be a hidden file.
How to restore attributes?
Your computer instincts will tell you to right click on the file(s) and go to properties, but you will later realize you cannot uncheck the hidden button. This is because the computer sees your files as a “system file”, system files are important and can cause damage to your computer if deleted or changed.
There are many ways to restore your file(s) attributes back to normal. But we will be using a program to make it easier for everyone - especially to those do not know how to use the windows command promt.
- Download the program called “Attribute Changer” (It is a freeware and not that hard to find on the web)
- Install the program (To check if the program has been installed properly, right click on any file and look for the “change attributes…” on the options)
- To restore your files, select all of your files (the ones with the dull color; you can also organize your files by type to help you identify your files from the ones created by the virus)
- Once your files had been highlighted, right click and go to “change attributes…”
- Uncheck the “system” and “hidden”
How can I remove the virus and the shortcuts?
Select all the shortcuts and virus then delete them (if the main virus file remains, change the attributes as you did before then delete)
To help protect your computer from being infected by these kind of viruses, choose an antivirus that blocks the “autorun.inf” file. I would recommend Avira Free Antivrus, since it does a good job in blocking viruses as well as protecting your computer.