Member Avatar for madmicmar

hi guys,

i just bought an hp windows xp pc for myself and happen to notice some strange behavior. whenever i create a folder, for example a new folder in my documents, the same folder (with folder icon but empty contents) is created inside that folder. when i click on it, it redirects to the my documents folder. its functions like a shortcut. when i delete it, it says deleting new folder.exe. so now i figured its some sort of application pretending to be a folder. after deleting it and when i restart my computer the folder is there again. to me its annoying and seems its behavior is like a virus. i am wondering if this is related to the missing folder options problem that i am encountering just the same. i hope that some of you have encountered this same problem and help me resolve it. thanks guys. i'll be waiting for yor reply.

  • 8 Contributors
  • 9 Replies
  • 285 Views
  • 2 Years Discussion Span
  • Latest Post Latest Post by sittas87

Dani AI

Generated

This thread describes a textbook AutoRun/USB worm: an executable disguised with a folder icon that drops copies and an autorun.inf so the “same-named folder/.exe” reappears after deletion. Several posters suspected malware and removal tools; that behavior (autorun + copy/persist) is exactly how autorun-style worms propagate. (f-secure.com)

Practical immediate steps (do not open infected drives; use a known-clean PC or Safe Mode where possible). From an elevated Command Prompt on a clean machine, change to the removable drive letter and remove system/hidden/read‑only attributes, then remove autorun/shortcut files. Example (replace E: with the actual drive letter):

E:
attrib -s -h -r *.* /s /d
del /f /q autorun.inf
del /f /q *.lnk
del /f /q "New Folder.exe"

The attrib command is the supported Windows way to change file attributes; the pattern above is the common manual-recovery sequence used for USB autorun/shortcut infections. (learn.microsoft.com)

After cleaning removable media, address the infected PC itself. Boot into Safe Mode if the worm resists deletion, run current offline/bootable or on-demand scanners (for example Malwarebytes or Microsoft Safety Scanner), and then remove persistent autostart entries (Run keys, scheduled tasks, and IFEO debugger keys) with an autorun-inspection tool (Sysinternals Autoruns) before rebooting. Some variants inject explorer or set debugger keys to restart on logon, so check those locations. (help.malwarebytes.com)

Prevention and final notes: after cleanup, disable AutoRun/AutoPlay via the supported policy/registry approach (see Microsoft guidance and KB updates for correctly disabling autorun), keep AV definitions current, and back up critical files rather than relying on a single USB stick. For stubborn USB infections consider proven utilities (many forums recommend tools like Flash_Disinfector) and, as a last resort after files are recovered, reformat the drive. Back up the registry or create a System Restore point before making manual registry edits. (learn.microsoft.com)

Acknowledgement: ’s symptom description matches this class of worm, and replies from and pointing to AV/cleanup were on the right track.

Recommended Answers

All 9 Replies

Member Avatar for chris5126

Hey if its a new comp reformat could be a problem with windows registery or it could be infected with a virus or spyware if that is not an option then use ewido to do a scan see if you have any spyware if not there have been a few more problems like this search this forum to see how they were solved.

Member Avatar for madmicmar

Hey if its a new comp reformat could be a problem with windows registery or it could be infected with a virus or spyware if that is not an option then use ewido to do a scan see if you have any spyware if not there have been a few more problems like this search this forum to see how they were solved.

thanks to your reply. i did a lot of research and got info that my pc was infected of rontokbro virus. i have printed few info and started fixing them. i have cleaned the virus and all i need to do now is do the registry since the virus has changed it. i'm checking out some tools to do this. thanks for your reply though. i appreciate it.

Member Avatar for ghanu

hi guys,

i just bought an hp windows xp pc for myself and happen to notice some strange behavior. whenever i create a folder, for example a new folder in my documents, the same folder (with folder icon but empty contents) is created inside that folder. when i click on it, it redirects to the my documents folder. its functions like a shortcut. when i delete it, it says deleting new folder.exe. so now i figured its some sort of application pretending to be a folder. after deleting it and when i restart my computer the folder is there again. to me its annoying and seems its behavior is like a virus. i am wondering if this is related to the missing folder options problem that i am encountering just the same. i hope that some of you have encountered this same problem and help me resolve it. thanks guys. i'll be waiting for yor reply.
pl send me.

Member Avatar for burs

i am suffering same problem. so pleas could u tell how can solve this problem

Member Avatar for hamada_1990

dude it is a VIRUS i had it too avast and deleted it

Member Avatar for nasirqazi

helo

Member Avatar for nasirqazi

I am facing the same problem, the same name folders are being created itself and regenerated automatically even after being deleted. and secondly got china USB virus. please advise me

Member Avatar for ashishmittal

sir,


pls help me


I have a pen drive. Today i see some named folders with the same name that has a exe extension.

1. When i double click on the same nothing will be happen.
2. When i format the same pen drive it cann't be formatted.

Now I am confused what will i do?


[ ashish mittal ]

Member Avatar for sittas87

sir,


pls help me


I have a pen drive. Today i see some named folders with the same name that has a exe extension.

1. When i double click on the same nothing will be happen.
2. When i format the same pen drive it cann't be formatted.

Now I am confused what will i do?


[ ashish mittal ]

Hi there
What do you mean it cant be formatted.what happens when you try to format?error massage? anything?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.