The files on the flash drive became labels. Why did all the folders on the flash drive become labels?

It must be the flash drives that are most often affected today, being the most common devices. Any viruses, "rootkits", "trojans" primarily attack this type of media. Often after infection of the drive, the user notices that on the USB flash drive, folders and files have become labels. In this case, it is not possible to extract or read information from a directory or file. Of course, no one will prohibit formatting the drive and get rid of the problem in one fell swoop, but if the file system stores important data, such an option is impossible. Why all the folders on the flash drive became labels and how to cope with this problem? This will be described in the article.

About viruses and users

An ordinary user, faced with a problem, acts like this: just clicks on each shortcut in an attempt to access at least one directory. The second scenario is formatting, which does not solve the problem, and if it decides (in the absence of important data), then for a short time.

Remember, the information from the flash drive does not disappear anywhere. All folders have become shortcuts, and the folders themselves are hidden, but not deleted. Data continues to be in place, but the virus disguised them, trying to provide links to the launch of malicious code for the original content. It follows that clicking on these links is not worth it, even if they open the necessary directory. Typically, a malicious program creates shortcuts that reference a special service file, where two commands are invested. The first loads the virus into memory and copies it to the hard drive of the computer, the second - opens the user's directory.

But do not think that if the files and folders on the USB flash drive turned into a shortcut, but did not open, the virus did not penetrate the local machine. Most likely, malware has already moved to the user's computer. Excluded this feature only if the operating system disconnected autorun from removable media or installed an antivirus with the latest virus databases.

Virus removal: manual methods

Before you restore the original directory type, you need to remove the malware. You can do it manually or in automatic mode. In the first case, you need to find out where the virus program file is located.

Right-click the shortcut and select the "Properties" line. Pay attention to the area called "Object". Here is the full path to the program that runs the virus. Just because of him, the files on the flash drive became labels. In almost all cases, each label will refer to the same data area on the storage medium. It should be deleted. If malware is located in a directory that was created by itself (that is, before this directory on the flash drive was not), you can delete all its contents.

In addition to the flash drive, also check the directory roots:

• C: \ Users \ UserName \ AppData \ Roaming.
• From: \ Documents and Setting \ UserName \ Local Settings \ Applications Data.

If you find in them any executable file (with the extension exe), most likely, your computer is infected, and you need to use an antivirus program.

Virus removal by specialized software

If the files on the flash drive become labels, then to completely get rid of the malicious programs, and at the same time and to hedge, you need to check the anti-virus scanner, not only a flash drive, but the entire computer. In this case, often malicious software injects its code into an antivirus already installed on the machine, so it's best to use a special boot drive that can be easily created. And the developers themselves of the anvirus screens contribute to the development of this segment of applications.

Creating a Bootable CD

Even a novice user can cope with this task. The algorithm of actions is as follows:

• Download Dr.Web LiveDisk from the official website of the developer.
• Download the UltraISO program and install. At the same time, during the installation of the application, its functions will be integrated into the conductor, which will make the burning process the simplest.
• Double-click the LiveDisk image file. Then the UltraISO window will open. The user will only need to click on the "Record" button, after inserting a blank disc into the DVD-ROM.
• After a few minutes, the boot drive is ready.

Creating a bootable USB flash drive

There are cases when the files on the USB flash drive become a shortcut, but there is no blank disk at hand, or a CD-ROM drive is not installed in the computer at all. Then you can create a bootable USB flash drive. And this procedure is more simple and quicker than burned CD.

• Download the Dr.Web LiveDisk distribution for USB-drives from the official site.
• Run "drwebliveusb.exe" (it is advisable to perform this operation on behalf of the administrator).
• Do not forget to insert the flash drive into the USB port.
• In the drop-down menu, select the device to which LiveDisk will be recorded.
• Check the box next to "Format" and click "Create LiveUsb"
• When all processes are complete, click "Exit".

Preparing for download

After creating a bootable flash drive or disk, you need to configure the BIOS. To enter the configuration utility, you will have to press the "DEL" key (at least - "F12") on the very initial screen of the computer boot. Watch for messages appearing on the screen to understand which button is responsible for entering the BIOS. The required line will look like: "Press [button name] to enter setup".

After entering the BIOS, go to the "Advanced" or "Boot" tab, and select "CD-ROM" or "USB" in the "First Boot Device" line. To exit with saving changes, go to the "Queet" tab and select "Exit and Save". The computer will automatically reboot and start using the device that was previously specified by the user as the system one.

Checking your computer

If you have shortcuts on your drive instead of folders, restoring the folders on the USB flash drive can not be done without a full scan. Of course, you can reset the attributes and save all the data in another place, then format the device and forget about the problem, but this method of solution can not be considered complete, because it is impossible to track the work of the virus. It is likely that he is already in full force "host" on the computer.

The initial screen of the LiveDisk bootloader displays a menu with the following items:

• Default (normal download).
• Safe mode (safe mode, which can help if the previous version does not work).
• Start local HDD (boot from hard disk).
• Testing Memory.

Choose either the first or the second item.

Wait for a while until the desktop appears. At the same time, the Control Center should automatically start. If this does not happen, click on the analogue of the "Start" button, which is in the lower right corner of the desktop and has the appearance of a spider, select "Control Center".

In the top menu of the window that opens, click on "Tools" and select "Settings". The first tab will provide a choice of actions applicable to dangerous objects. Set each line to "Delete".

The second tab is called "Scanner". In the lower part of it there are two fields for input. The first one sets the maximum size of the scanned files. It is better to set the value to "0" to disable the restriction. The second specifies the maximum number of checks for a single file. It is recommended to set the value to "5". And be sure to check the box next to "Scan archives". After configuration, the window can be closed.

In the "Control Center", open the "Scanner" tab and select "Custom Scan". Here, select the checkboxes for all drives and click on the "Scan" button.

The scan time depends on the volume of all hard disks and the speed of their operation. Have enough patience. After the end of the scan, click on "Exit". Do not forget to change the values in the BIOS to those that were before running LiveDisk.

Restore attributes

If the folders become shortcuts, the solution to the problem lies not only in checking the computer and the drive for viruses. After removing the malicious code, you need to return all files and directories. As noted earlier, they stayed on the flash drive, but are hidden from the user. Simply changing the attributes allowed to create the visibility that there are no directories. The same simple change will allow you to display the contents again. There are several ways that you can perform this operation.

Method one

Open a Windows command prompt. For this:

• Click the "Start" button and select "Run."
• In the information input line, type "cmd" and click on the "OK" button (or just press "ENTER" after entering). The command prompt opens.
• First enter the command "cd / d X: \" and press the "ENTER" key. Instead of "X", you must specify the drive letter that is installed on your computer.
• Next, type "attrib -s -h / d / s".

After performing the above actions, the files and directories will return to their rightful place. With them, you can continue to work, as well as before a virus attack.

Method of the second

If the files on the flash drive become labels, you can automate the process of resetting the attributes to the initial ones. But for automation it is necessary to do a simple procedure:

• Open the notepad. This can be done from the "Start" menu, following the path "Standard - Notepad", or enter "notepad" in the "Run" window.
• In the Notepad, type the line "attrib -s -h / d / s".
• Click on the "File" icon of the top menu of the program and select "Save".
• Specify a name for the file to be saved, for example: "name.bat". Be careful: after the point you need to write "bat", otherwise the file will open in a notebook, which will not lead to the desired result.
• Move the saved file to the root of the flash drive.
• After copying, just run it like any other program.
• You can leave the file in case the virus resides on the flash drive.

Prevention

If there are shortcuts on the flash drive instead of folders, but this is not the first time, an excellent way to secure your machine will be to disable autoloading from all devices, be it a USB drive, at least a hard drive, or a DVD drive.

The matter is that when you connect any drive, the operating system reads the list of files. This is very convenient, because you can configure that when the music disc is inserted, the player automatically turns on, and if there are a lot of text files on the flash drive, its contents are displayed automatically in the explorer. That's only if in the root of the file system of the device is "autorun.inf", the operating system ignores any such settings and executes the commands written in this file. Use this behavior of the OS can be both good and bad, which is what the creators of viruses use. It turns out that first the code of the malicious program is copied to the computer using this file, and then the machine itself writes down such files to each new drive, and the files on the flash drive become labels.

The proposed version of prevention is perfect if the flash drive is often used on different computers. That is, malicious code located on a foreign machine can be written to the drive, but it will not spread to the local computer. It will only check the USB flash drive with anti-virus tools and restore the attributes of the directories.

In the Windows family, starting from Vista, autorun can be disabled in two ways. The first option, which is not suitable for owners of Windows XP, is as follows:

• Open the "Start" menu and select "Control Panel" in it.
• Here, find the item with the spoken name "Autostart".
• Uncheck the box in the checkbox next to "Use autorun for all media".

The second method is more difficult, however it can be used also in the event that files on a flash drive become labels, and the computer uses Windows XP:

• Click Start, and then click Run.
• In the line that opens, type "gpedit.msc" and click "OK" or "ENTER". Group Policy settings are displayed.
• In the left part of the window, expand the "Computer Configuration" - "Administrative Templates" - "Windows Components" - "AutoPlay Policy".
• The right side displays the possible settings. In the drop-down menu, you must select the option "Disable autorun", and then click on the "OK" button.
• The changes will be saved, but will not take effect until the computer is restarted. You can work around this limitation.
• Open the "Run" window and enter the "gpupdate" command in it. A command line with "Policy Update" will appear on the screen. The operation will take several minutes, after the window is closed, the changes will be applied.