Member Avatar for c-tech

hi guys. i have a problem with my computer. i can't show hidden files/folders on my computer. i've even tried showing them through the registry keys related but somehow the values i change seem to default to their previous values. I've also noticed a file in my flashdisk even after formatting and reformatting it E.COM .i suspect that this is a virus and i've tried to scan it with Kaspersky Internet Security 7.0 but it is seen as a normal file. I need to be able to show the hidden files since this file itself is hidden and cannot be deleted manually. your help will be greatly appreciated. Thanks.

  • 2 Contributors
  • 1 Reply
  • 135 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by jholland1964

Dani AI

Generated

This looks like a typical USB/autorun worm: it hides folders, flips Folder Options/registry entries back, and drops a payload (here E.COM) onto removable media. Formatting the stick while the PC is infected will just let the worm re-copy itself the next time the drive is inserted. As already suggested, post a new thread and collect logs (HijackThis/MBAM/etc.) so helpers can see what is running — but first take these immediate steps.

Do this before touching the USB again: disconnect other removable drives, do not open files from the infected stick, and work from a known-clean environment (boot Safe Mode or use a rescue/clean machine).

To remove attributes and delete the visible/hidden files from the USB (replace E: with the actual drive letter), run Command Prompt as administrator and:

attrib -h -s -r /s /d E:\*.*
del /f /q E:\autorun.inf
del /f /q E:\E.COM

If a file is reported "in use", reboot into Safe Mode (or use a Linux live USB) and repeat the commands.

If registry settings for showing hidden files keep reverting, check for these common places a worm uses to block changes: the Explorer policy keys under
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
and the "Advanced" keys under
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced.
If you see forced policies (for example a NoFolderOptions entry), remove them only after killing the malware process. Use Autoruns (Sysinternals) to find and disable suspicious autorun/Startup entries, then run a full scan with a current anti‑malware tool (Malwarebytes, a rescue CD/USB scanner, or an offline scanner) and reboot.

If the stick keeps getting re-infected after the PC is cleaned, consider the stick compromised and replace it (firmware infections are rare but possible). Back up only user documents (not executables) and scan backups on a clean machine before reuse.

Member Avatar for jholland1964

This is not where this question should be asked, you won't get any answers here, this is a Poll thread. Please create your OWN thread stating your problems, AFTER following the steps given HERE
especially steps #8 and #9 followed by a scan with HiJackThis that can be found
Create your own thread, state your problems and then include the logs from the three programs above. Be sure to follow instructions for the two scans EXACTLY, including FIXING with MBA-M.
Then somebody will be able to help you.
Judy

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.