☩ Walking in Light with Christ – Faith, Computing, Diary

I was asked today to fix a computer with 682 GB external Hard Drive attached. For some unexplainable reason, many of the Directories storing hundreds of gygas of precious data become showing up as "Broken Links" – Missing Shortcuts. My first logical guess is that maybe, just a simple hard drive re-attach will be enough in order to solve the problem. Detaching and Attaching the external Seagate hard drive made any change, whether opening the hard drive content with Windows File Explorer, most directories were just showing as Missing Shortcuts, like you can see from below screenshot:

I was a bit sleepy and in a hurry, so at first glimpse I didn't well read the Pop-upped Windows exact error, after carefully reading, I've realized the 689342.exe and the rest of ID.EXE that were trying to open, whether clicked on the "questionable", missing shortcuts is for sure some kind of most likely Polymorphous Spyware / Virus or a combination of both.

The person owning the computer, was quite in shock as most of his data was located on the external HD drive. My assumption of course was that the problem is not so severe as it looks, as I've fixed plenty of Windows-es with mixed up registry, which were mixing how Windows understands windows extensions.
My hope was that the problem will be solved by simply Checking the Windows Registry with – Little Registry Cleaner tool and fixing the irregularitieswith current registry, thus I did a quick scan with it fixed a bunch of registry problems, did the usual Windows restart, but this helped not. Thus I, therefore started a Malware Bytes Anti-Malware Spyware "Swiss Army Knife" prog 🙂. Paralelly with scanning I decided to check if physically files are present on Hard Disk, by dir listing the files in Windows command prompt – cmd.exe , there all seemed okay files and directories were present, I can CD into each of the directories incorrectly showing in Win File Explorer as missing shortcut and all inside dirs was just fine.

 

I checked for "autorun.inf", as it is so common nowadays that external Hard Drives and USB Sticks are infected with Autorun Virus variations and my guess happened to be right, there was F:\autorun.inf. As it is with the Autorun Virus-es the file was set the hidden and read-only atrribs. I checked it is there with:

> dir /a autorun.inf
...


Then I deleted autorun.inf, by reverting the "hidden and read-only attribs:

> attrib -s -h -r autorun.inf
> del autorun.inf


Though, I hoped this would solve the problem, checking f:\ Directories in File Explorer, continued to be showing Folders linked to the unexisting 689342.exe. Then I read some posts online, discussing the weird "Missing Shortcuts" issue and after a while thx God I finally got the fix, which is as simple as:

> attrib -r -s -h /s /d f:\*.*


This command, took about 20 minutes or so, as there are plenty of data on the hard drive. Also I suppose in some rare occasions the removal of read only, system and hidden windows attributes, might create issues of certain programs installed, however in this specific PC case all was okay and it doesn't really mattered as the really important files to rescue were mostly in .DOC's DJVu, PDF and plain text format along with some movies

As you can see on below screenshot, I had the Malware Bytes running in parallel along with a Working copy of Avira Free Antivirus, while the above command was running Avira immediately detected a bunch of Virus files, which were offered to be Removed or Quarantined.

After removing, all of the badware and testing in Explorer, all folders in F:\ were showing as normal.
However, though all looked fine, after the completion of Malware Bytes scan and the removal of catched Malware, just to be sure something has not left as viruses I run oneanother Avira AV scan of all Computer Hard drives and did a Restart. This is it enjoy 😉