Member Avatar for shrirangphadke

Hi ! guys ...
there is one Dangerous Virus in my system ..
it creates .exe file in every folder, present on a Pen-drive(it's affecting only Pen-drives).. n that file gets converted into a folder icon (operating system thinks that it is a folder)...
All these files have memory exactly equal to 254KB...
even Zone Alarm unable to trace it....
pls can any one Help me regarding that ???

  • 2 Contributors
  • 3 Replies
  • 101 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by Suspishio

Dani AI

Generated

Symptoms reported by — many identical 254 KB .exe files on pen drives that show a folder icon — match the classic removable-media autorun/shortcut behavior: a launcher hides the real files and tries to spread when the drive is opened. ’s suggestion to collect diagnostic output (HijackThis/Autoruns) is useful; those logs show autorun entries, startup items and suspicious processes needed for precise cleanup.

Immediate containment (before any scans or transfers)

  • Do not double-click the fake folder icons or the .exe files.
  • Disconnect the affected drive from other computers.
  • Disable Windows AutoPlay/Autorun system-wide.

Basic reveal-and-clean commands (run from an elevated Command Prompt; replace X: with the USB drive letter)

attrib -h -r -s /s /d X:\*.*
del X:\autorun.inf

The attrib line clears hidden/system/readonly flags and recurses; deleting autorun.inf removes the usual automatic launcher. Run these only as Administrator and only on the suspected removable drive.

Scanning and deeper removal

  • Use an up-to-date antivirus plus a dedicated anti‑malware scanner (Malwarebytes, SuperAntiSpyware, etc.) to scan both the local PC and the USB. Firewalls (ZoneAlarm) often do not detect file-level infections on removable media.
  • If the malicious process resists deletion, boot the machine into Safe Mode or inspect the USB from a Linux live USB so Windows autorun cannot execute.
  • For uncertain samples, submit the suspicious .exe to a multi‑engine scanner service (VirusTotal) for identification before restoring files.

Cleanup and prevention

  • Remove leftover shortcut/launcher files, check startup and registry autorun keys with Autoruns or HijackThis output, and repair file attributes on the drive.
  • If recovery is unreliable, copy recovered user files to a clean system and reformat the drive.
  • Keep AV signatures current, disable autorun, and avoid running unknown .exe from removable media.

A HijackThis/Autoruns log gives the exact autorun/startup entries that these worms use; that output is the next useful diagnostic for targeted removal.

Recommended Answers

All 3 Replies

Member Avatar for Suspishio

A HijackThis log would be helpful.

Member Avatar for shrirangphadke

Hijack this log ??? .. i m new to Daniweb can u pls explain briefly ?

Member Avatar for Suspishio

Welcome to Daniweb. Read the spyware posts in this forum and it'll tell you where to find Hijack This and what to do to get it going.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.