External HDD can't be open but can be partially detected

jumanji said:

Does your computer detect other external drives/ pen drives plugged into it?

Not sure, gonna try it sometime since my friend borrowed my USB, I'll try to use other devices, I'll try to use my camera to connect to the PC, I'll see if it works. Also can you help me access my drive from another computer?Because a shortcut is not letting me get inside the drive, just refer to post #8, the lower 2 pictures. So if something bad happens, I still have a backup.
Edit: Here's the pic with the Winrar used to open the drive:
Edit 2: Never mind for opening the drive, I already opened it thanks to this thread:
http://answers.microsoft.com/en-us/w...7-41671457fe11
I just need to know how to open my drive in MY PC.

OK, As I said in my previous post, your external drive is inflicted with shortcut virus and you should be able to access your files once you get rid of it. I presume that you got that virus from the internet café.

I was thinking whether the shortcut virus was preventing access to your external drive on your PC. Reason why I wanted you to try another external HDD/pen drive on your PC.

Now you can try two things.

1.Take your external drive to a friend's PC ( Not to an Internet café :)) and try out its removal as outlined in my post #9 using WinRAR. Just take a snapshot or note down the contents of the autorun.inf file displayed in Notepad and then delete it. You may also delete any other file/folder that is not your data file. Also delete the Recycle Bin ( It will be recreated ) and the System Volume Information. Though SIV folder will not be deleted, I think the files inside will be deleted. All deletions to be performed in WinRAR. Now you can close WinRAR, safely remove the external drive and then plug it in. You should be able to access your files now. If those still remain hidden, then

Click on Start type cmd in the Search field and press Enter

Click on cmd.exe to open the Command Window.

Enter this command.

attrib -h -r -s /s /d g:\*.* (replace g with the actual external drive letter)

(You can copy and paste the above command but remember to put in the correct drive letter.)

Now press "Enter".

Now check for your files in your external drive.

2. Before you try this procedure with a friend's PC, I have been thinking aloud, why not try it on your own PC. No harm will be done. Make sure in both cases that you keep the left shift key pressed while you plug in the external drive. That will disable autorun, and your PC and WinRAR should be able to see the drive if that was what was preventing access to your external drive. If you can explore it in WinRAR follow the same procedure to get rid of the shortcut virus.

EDIT: I just saw your edited post.

Opening the drive with Jamesarntz's procedure what exactly did you do? Have you gotten rid of the virus and got your data back in the drive visible and accessible? And on which computer? Just curious.

Anyway, click OK on the error message to make it disappear and then delete all the files/folders that are not your data. I see only the one named File Folder in the WinRAR screenshot. Is that your data folder? Double click on it to open and confirm all your data is there. Delete all other files/folders in the WinRAR explorer.

Error code 45:
This error occurs if a device that was previously connected to the computer is no longer connected. To resolve this problem, reconnect this hardware device to the computer.

No resolution is necessary. This error code is only used to indicate the disconnected status of the device and does not require you to resolve it. The error code resolves automatically when you connect the associated device to the computer.

This is the general prescription .

Even after disconnecting and reconnecting the external USB device if you get the same message then 1.Your external device has gone bad or 2. The connecting cable is faulty or 3. the connections are loose.

Again a general diagnosis.

All this however does not apply in your case. We are pretty much sure that your external hard disk is OK, the data is still there and the virus is still there. It may be preventing Windows from accessing the drive resulting in that error message. I very clearly thought of this possibility and that is why I asked you to connect another pen drive or external drive and check whether your system is able to recognise those. That would categorically establish whether it is the true state of affairs.

I am also not happy that you have failed to follow the instructions given.

1. Even when you opened the Hard drive with WinRAR ( let it be any computer) and could see all the files/folders (your screenshot at post #12) you made no effort to delete all unwanted files keeping only your data folders/files.

2. You also followed Jamesarntz's post to unhide all the files/folders - well, it is yet another way of doing the same thing - but still did not delete the unwanted files/folders. (Well, it was a slightly variant case, but still you could have deleted the unwanted files.)

In both cases you could have opened the only unnamed folder and checked whether all your data is there before deleting all other files/folders


Anyway please do the same on your computer.


1. Check whether your computer recognises the external drive when you plug it in with Left Shift key pressed.

2. If it does then open it and check - you can use any of the above two methods.

3. Open and check the only unnamed folder is your data folder and confirm all your data is there.

4. Then delete all other files and folders and then safely remove it.

5. Shut down your computer, reboot, plug in your external drive and check whether everything is OK.

Note : Your computer may also be infected with Malware. I would suggest that that you do a quick scan running Malwarebytes in Windows safe mode and cleanse your PC first before doing any of the above procedure. You can download and watch the demo here http://www.malwarebytes.org/products/malwarebytes_free/

I see you are there right now.

Your case is similar to the one here, External Hard Drive error ~$WV.FAT32
where the OP was able to successfully copy all data into another external drive after following the WinRAR procedure.

He got into further problems when sanitising the external drive because his computer was infected. This necessitated cleansing of his computer following a rigorous procedure outlined by cottonball.

Reason why I am advising you to cleanse your PC of all malware before proceeding further.

Now you know, why I wanted you to do that on a friend's PC - which I have presumed to be clean PC -not wanting to take any chances on your PC. :)

Here's the result of the quick scan with Malwarebytes during safe mode with connection. The Mbam is still on, just minimized it. I'm fine with the folders being deleted but not sure about the registry keys, I'll wait for more info here on what to do. I'll restart my PC in to normal mode, and plug a USB device to test it later after someone tells me what to do with Mbam.
Note: vendor names with prefix "PUP" has no checks on it, should that be deleted or just stay?

Code:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.04.12.01

Windows 7 Service Pack 1 x86 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
patrick :: PATRICK-HP [administrator]

4/12/2013 9:41:14 AM
MBAM-log-2013-04-12 (09-48-33).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 250654
Time elapsed: 7 minute(s), 2 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 6
HKCR\CLSID\{CA4520F3-AE13-4FB1-A513-58E23991C86D} (Trojan.Downloader) -> No action taken.
HKCR\gencrawler_gc.GenCrawler (Trojan.Downloader) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA4520F3-AE13-4FB1-A513-58E23991C86D} (Trojan.Downloader) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{CA4520F3-AE13-4FB1-A513-58E23991C86D} (Trojan.Downloader) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA4520F3-AE13-4FB1-A513-58E23991C86D} (Trojan.Downloader) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59EA5FF9-DEB5-4858-9185-F7CD3AB01C25} (PUP.wxDfast) -> No action taken.

Registry Values Detected: 3
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|46607 (Trojan.Ransom.WL) -> Data: C:\PROGRA~2\LOCALS~1\Temp\msqiuowu.exe -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (PUM.UserWLoad) -> Data: C:\Users\patrick\LOCALS~1\Temp\mscfwvo.bat -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (Trojan.Ransom) -> Data: C:\Users\patrick\LOCALS~1\Temp\mscfwvo.bat -> No action taken.

Registry Data Items Detected: 1
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (Trojan.Ransom.WL) -> Bad: (C:\Users\patrick\LOCALS~1\Temp\mscfwvo.bat) Good: () -> No action taken.

Folders Detected: 4
C:\ProgramData\wxDfast (PUP.wxDfast) -> No action taken.
C:\ProgramData\wxDfast\data (PUP.wxDfast) -> No action taken.
C:\ProgramData\Codec-C (PUP.CodecC) -> No action taken.
C:\ProgramData\Codec-C\data (PUP.CodecC) -> No action taken.

Files Detected: 59
C:\ProgramData\Local Settings\Temp\msqiuowu.exe (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\Local Settings\Temp\mscfwvo.bat (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Roaming\Media Finder\Extensions\gencrawler_gc.dll (Trojan.Downloader) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msaflqvik.pif (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msaqawzu.scr (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msatyv.exe (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msavctukz.exe (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msavouli.scr (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msavwfhhu.exe (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msbawrw.com (Trojan.Dropper.nsdrp) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msbopqy.com (Spyware.Zbot) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msbowti.com (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msbvimp.com (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mscfske.bat (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mscfwvo.bat (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mschzoe.bat (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mseahy.exe (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mseiuadq.scr (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msevzavv.scr (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msifqiaua.pif (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msiiosqtx.exe (Trojan.Dropper.nsdrp) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msiozazzu.exe (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msipilaai.exe (Spyware.Zbot) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msiqklia.com (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msitvautr.exe (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msiwevro.com (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msocat.bat (Trojan.Dropper.nsdrp) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msofmro.bat (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msojqcz.bat (Trojan.Dropper.nsdrp) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msqfeehy.bat (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msqhmokao.pif (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msqirxay.com (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mstauxnuv.pif (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mstfurivy.pif (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\msvmlz.com (Trojan.Dropper.nsdrp) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mswmvs.exe (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mswqaoi.scr (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mswqihx.com (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mszegiav.scr (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mszeiu.cmd (Trojan.Ransom.WL) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\mszvuq.cmd (Trojan.Ransom.WL) -> No action taken.
C:\$RECYCLE.BIN\S-1-5-21-1684045860-3113741293-3062281249-1000\$R8DIHTP.GHOST\C&C Zero Hour +3 Trainer English v 1.4.exe (PUP.HackTool.HotKeysHook) -> No action taken.
C:\TEMP\TrustedInstaller.exe (Spyware.Zbot) -> No action taken.
C:\Users\patrick\Downloads\installer_adobe_photoshop.exe (PUP.BundleInstaller.BT) -> No action taken.
C:\Users\patrick\AppData\Local\Temp\noir.art (Malware.Trace) -> No action taken.
C:\Users\patrick\Local Settings\TempDIR\BetterInstaller.exe (PUP.BundleInstaller.Somoto) -> No action taken.
C:\ProgramData\wxDfast\background.html (PUP.wxDfast) -> No action taken.
C:\ProgramData\wxDfast\content.js (PUP.wxDfast) -> No action taken.
C:\ProgramData\wxDfast\mdpmbgnafjopenakodmonbgbnaiohklc.crx (PUP.wxDfast) -> No action taken.
C:\ProgramData\wxDfast\settings.ini (PUP.wxDfast) -> No action taken.
C:\ProgramData\wxDfast\data\content.js (PUP.wxDfast) -> No action taken.
C:\ProgramData\wxDfast\data\jsondb.js (PUP.wxDfast) -> No action taken.
C:\ProgramData\Codec-C\background.html (PUP.CodecC) -> No action taken.
C:\ProgramData\Codec-C\content.js (PUP.CodecC) -> No action taken.
C:\ProgramData\Codec-C\ekdjfcdinekpfcedakhpngcnaamhiihn.crx (PUP.CodecC) -> No action taken.
C:\ProgramData\Codec-C\settings.ini (PUP.CodecC) -> No action taken.
C:\ProgramData\Codec-C\uninstall.exe (PUP.CodecC) -> No action taken.
C:\ProgramData\Codec-C\data\content.js (PUP.CodecC) -> No action taken.
C:\ProgramData\Codec-C\data\jsondb.js (PUP.CodecC) -> No action taken.

(end)

Edit: I restarted my PC so I can test USB devices and see if it works, I exited Mbam now and I'll just rescan later in safe mode.
Edit 2: My PC detected a my camera, plugged the USB and it works.

Rain08,

We will get to Malwarebytes later.

For now, please plug in the external HDD with the problem to the USB port that you normally use.

Next, download RogueKiller:
Tlcharger RogueKiller (Site Officiel)

When you get to the website, go to where it says:
(Download link) Lien de téléchargement:
Select the version for your system: 32-bit
Click the dark-blue button without x64.
Save to the Desktop.

Close all windows and browsers.

Right-click and select: Run as Administrator

At the program console, wait for the prescan to finish. (Under Status, it says: Prescan finished.)

Press: SCAN

When done, a report opens on the Desktop: RKreport.txt
Please provide the RKreport.txt (Mode: Scan) in your reply.


A couple of questions..., how large (GB) is the external HDD?
Also, what AntiVirus program do you use?