All the files on my external drive have been replaced by a single shortcut which can no longer be opened

Question

Here is what happened after I used Malwarebytes Anti-Malware:

Before I used Malwarebytes Anti-Malware I could still open that shortcut. I know that a virus made that shortcut and so I tried to remove it, but after using Malwarebytes Anti-Malware things are worse. I can't even open the shortcut now. Can someone help?

Answer 1

• view hidden files and folders AND system files. Maybe the virus set the "hidden" attribute on all your data. I can see from your screenshot that the shortcut is only 698 bytes, so it is a real shortcut, rather than a folder made to look like a shortcut by the virus. In other words, the data was never inside it- yet it was still on that drive. This means the data must be in a hidden folder in the root directory of the external hard drive.
• Look at the total data on your external drive (right click on the external drive and open "properties"). I doubt it's empty. Check it out- what you see will probably be reassuring.
• delete the "autorun.inf" file the virus created, and anything else hidden in the root you recognize as having been created by the virus. You want to manually clean out any monkey business the virus hid on that drive so it starts behaving properly again.

Here's how to view hidden files and system files:

Answer 2

Hey I have encountered the same problem and the solution is simple!

What the virus does is: 1. Move all your files to a single folder (the name of the folder is ' ') 2. Hide that folder with attributes SHR (System, Hidden, Read-Only)

The trickiest part is that the shortcut lets you access your files if you open it but will run a background virus as well.

Solution:

1. The shortcut is irrelevant, you might as well delete it.
2. Set show hidden files and folders AND system files on
3. Uncheck 'Hide protected operating system files' Look at 'Kim Jong-Un' answer for details
4. You should find a folder with no name (actual it is named by a simple space which you can write by the unicode (ALT+0160)
5. Open the folder to access your files and unhide it for later use by going to properties

N.B. If the virus is on your PC, I recommend you no to move your files back out of the "space" folder unless you clean your PC, because all the moving of files will possibly make you lose your files.

I would have posted a screen-shot but my rep is low I guess.