[Fixed] Recover Virus Infected Data Changed to .lnk Shortcut File in USB
http://iamsamer.blogspot.com/2014/03/fixed-recover-virus-infected-data.html
When this problem happens with your USB flash or external drive that all important files converted, changed or shows to shortcuts then I can understand the mental state of a person whose having all of his important files in his USB or external hard drive because that thing happened with me once in a life time and that time I can't even tell you how much I was disturbed but luckily recovered from one of my licensed antivirus (Bitdefender internet security 2013) after spending 2 days and one night.
I googled my issue and came to know that there were many people like me facing the same problem, it most of the time happens when your files and folders in USB pen drive infected by malware Virus and they changed your data into shortcuts, I luckily recovered all my data.
But here we'll try something different than using any Antivirus program, we'll do everything from command prompt. Yes, you are right command prompt, if you think CMD is outdated after launching Windows 7 and 8 and there is no use of this black screen then you probably don't know the power of command prompt.
But here we'll try something different than using any Antivirus program, we'll do everything from command prompt. Yes, you are right command prompt, if you think CMD is outdated after launching Windows 7 and 8 and there is no use of this black screen then you probably don't know the power of command prompt.
First, remember one thing that don't format your drive if all your data has changed into shortcuts, if you have done so then you'll need a data recovery software, here are 10 free data recovery application you can try. This tip will work only if the size on the drive is not changed, means your data is there but disturbed a bit.
Follow these commands:
1. First, check the drive letter of your USB or external drive like e,f or g. I have e drive for USB.
2. Then, open command prompt by pressing a Windows key + R or click start, search box and type CMD and run as administrator.
3. Type the following commands in command prompt:
attrib -h -r -s /s /d e:\*.*
(all with one space before, see this: attrib"space"-H"space"-R"space"-S"space"/S"space"/D"space"E:\*.*)
or
attrib -h -r -s /s /d e:\"Office Data"
(this command will work on separate folders in USB, if you know the name of your folders instead of root directory of your USB like above command)
4. As i said above that I have a USB with E drive letter, so change E in above command with your drive letter.
5. That's it, you'll probably get all your data back in your USB with shortcuts files, move all your folders and files to another location of your hard drive and fully format your USB disk.
Note:
You may get errors if you miss space between above commands, so read them twice and if you still face problem then share your errors with us in comments, I'll try to help you.
Recommended For You:
3. Type the following commands in command prompt:
attrib -h -r -s /s /d e:\*.*
(all with one space before, see this: attrib"space"-H"space"-R"space"-S"space"/S"space"/D"space"E:\*.*)
or
attrib -h -r -s /s /d e:\"Office Data"
(this command will work on separate folders in USB, if you know the name of your folders instead of root directory of your USB like above command)
4. As i said above that I have a USB with E drive letter, so change E in above command with your drive letter.
5. That's it, you'll probably get all your data back in your USB with shortcuts files, move all your folders and files to another location of your hard drive and fully format your USB disk.
Note:
You may get errors if you miss space between above commands, so read them twice and if you still face problem then share your errors with us in comments, I'll try to help you.
Recommended For You:
Great article!!! Thank maaan!!! :)
ReplyDeleteTHANK You geekomad! It Worked on my drive!!!!!!!!!!!
ReplyDeleteHi,
ReplyDeleteat first, it is necessary to remove the virus from your usb drive. It can look like KSM_System.vbs or something with vbs extension. When this file is removed, you can recover your hidden files by this command: attrib -r -s -h e:\*.* /S /D.
The links can be deleted.
Wow, Dude this was perfect, I had about 500GB that was contaminated and it all came back in 30 sec, THANK YOU.
ReplyDeleteYou are most welcome.:shy:
DeleteMr. Ahmad, thanks very much for your help. I think this happened when we plugged it into another computer. A threat was picked up and wiped but all the files were left in .lnk format...thankfully they're saved. However is it necessary to remove the files from the USB after this has been completed and format the USB, or can I simply leave the USB alone now?
ReplyDeleteLEGEND!
ReplyDeleteThank you so much! This worked beautifully!! I thought all my files were gone forever
ReplyDeleteThank you so much
ReplyDeleteSir, with the above command . Nothing is came back in my selected folder. My USB has been subject to vaccination to system man. My files with .exe and .exe.lnk extension have been deleted . The files only visible with recovery software. The files so recovered have either .exe or .exe.lnk. I want to recover those files and then want to format it. How to do it?
ReplyDeletewow sankyu saia kira gk bisa balik lagi terima kasih banyak :v
ReplyDeleteHello Mr. Shadab Samer Ahmad,
ReplyDeleteI have the same problem but with .swf extension shockwave flash object instead of .ink extension. I have internal storage drive and I tried the same command prompt but not working. I would appreciate if you can help me with this issue.
Thank you,
Dash