USB flash drive contents replaced with a single shortcut

By | February 27, 2013

I encountered a weird virus lately that has been infecting USB flash drives. It hides all your files inside an invisible folder and places a shortcut that seems to be pointing to the flash drive itself.

If you check the target location of the shortcut, it points to rundll32.exe which run a file with a name that starts with ‘~’. It seems to be running the code inside the desktop.ini too. Suspicious eh?

showing you the real contents of your flash drive. Ta Da!

 

Enough with the talk. Let’s proceed with the steps. Assuming your tech savvy-ness is at least Level 1.

1. open the command prompt. (If you can’t even do this, srsly..)

2. assuming that your target drive letter is L, type the following…

C:\> cd /d L:

L:\> attrib -s -h -a -r /s /d *.*

3. You should now see all the invisible files along with the shortcut. Delete them except the autorun.inf file.

4. Download Process Explorer by Sysinternals and Unlocker 1.9 by Collomb.

5. Use the Unlocker and determine the process that is using the autorun.inf

sorry for the image, imgur.com kills the quality. In the image, wuauclt.exe is using the autorun.inf

 

6. Open the Process Explorer and look for the process. Press CTRL+L and sort the ‘type’ column. Scroll down to the ‘file’ type.

Those green thingys? Well that’s just the virus trying to create a backdoor. neat right? :D

 

7. You should see the autorun.inf being used by the process. If you don’t see it, you are looking at the wrong process. Right click the row and select Close handle.

8. The autorun.inf should be removable already. Next we need to see if there is already a backdoor in our computer. Look again at the ‘files’ being used by the process and search something suspicious. Typically found in your C:\users\your-username-here. Look for something like this.

AppData\Local\Temp\mstuaespm.pif

9. Close the handle, just like what you did in autorun.inf then remove the file inside your drive.

That’s is all for now. I just did this quick post since someone asked me in twitter how to remove it.

You don’t really expect me to fit this tutorial in just 140 characters do you?

Here is my original question (investigation) at Stackoverflow

 

So you can’t find the backdoor file? Here’s an update!

For those who cannot find the pif file, take note that the file indicated is what I found in my system. Assuming from the name of the file itself, it is very random. This means that the backdoor file (the pif file I am referring to) might be named other than mstuaespm.pif. It might use other extensions and might be found in a different folder. To find the backdoor you need to find the suspicious file that is being used by the host process.

To help you find the file, you may want to check the MD5 hash of that file. Just go search for hashing tools online.

Here is the MD5 hash of the pif file I found

0ad45ef45df58feaca5b35765cc5db6e

If your suspected file has the same hash, it definitely means that you already caught the backdoor file. I suggest you check out my prior investigation on superuser site. Checkout the ‘additional information’ in the analysis of the pif file I found here. You will see below the different filenames used by the backdoor.

Since it has been detected by common antivirus softwares already, you might just do a ‘Full Scan’ of your system if that is what you want. Still, I don’t like antiviruses though. It hogs my already-slow laptop.

 

  • Dom

    Hi! The unlocker for my case does not does not detect any locking handle. Any details as to how to proceed? Thank you very much!

    • http://www.piratelufi.com lufi

      It means no one is using the autorun.inf file which ‘might’ mean that your computer is not infected. Just delete the autorun.inf and retry inserting the flash drive. If you see the same files with the autorun.inf, your computer is infected

      • Dom

        My antivirus program seemed to have detected the problem and deleted the worm on its own. Thanks a lot for your help!

        • edison uy

          which antivirus did you use?

          • http://www.piratelufi.com lufi

            I don’t use an antivirus .it hogs my memory

  • http://facebook.com/joevangjunior Joel Junior

    PROBLEM SOLVED: USB – Shortcut link (is it a virus?)
    CUT your files from the shortcut link (the virus) and PASTE it on your original USB STORAGE device (on the same place where the shortcut was). Delete that shortcut link, safety remove the usb, and restart your computer. Then reinsert the usb. The link doesn’t show up again. :p weeeeeeee

    • http://www.piratelufi.com lufi

      I really wouldn’t recommend opening that link. If you bothered to check the ‘Target Location’ of that link, it is way too suspicious to call rundll32.exe just to open your flash drive. right?

  • Mariel

    I followed everything here and was able to do it but when I reinsert my flashdrive, the same problem occurs again.

    • http://www.piratelufi.com lufi

      it means the backdoor (*.pif file) is not removed and still running.

      • flash

        I followed everything but still, when I reinsert my flash drive, the shortcut appears again. I have removed the *.pif file already. I even formatted my flash drive but the same thing happens.

        • http://www.piratelufi.com lufi

          it means the .pif file is not the backdoor. is the .pif file locking the autorun.inf file?

          • flash

            I don’ think so. Anyway, I’ve fixed it, well, my antivirus did. I saw the same problem posted on their website so I thought they have a solution for it. So, I updated my antivirus, backed up my files, ran a full scan, and restarted my computer. It found, I think three .pif files which Process Explorer only found one (I just did what you have posted above).

            Thanks by the way!

  • Essirahc

    When I close the handle, an error is pooping out hich says, “Closing handle requires administrative rights”. what shud i do? pls help…

    • http://www.piratelufi.com lufi

      run the process explorer as administrator

    • http://www.piratelufi.com lufi

      what do you mean it doesn’t work? if it doesn’t find anything delete it. it means (maybe) that your computer is not infected

  • Jeff

    Hi there, what if the process tree of the virus is in svchost.exe? does that mean that my computer is the one who has the virus?

    • http://www.piratelufi.com lufi

      yes, if it doesnt have sub processes try ending it. don’t worry if your computer crashes though.

      • Jim

        Mine is indeed on the tree of svchost.exe and it has a ton of sub processes. what do i do?

        • http://www.piratelufi.com lufi

          99% it is not the process you are looking for.

  • t23

    really helpful

  • a12

    I can’t see any “green thingys” on my process explorer. What should I do?

    • http://www.piratelufi.com lufi

      you might not have the backdoor too. since it indicates that the backdoor is connecting to the internet

  • http://twitter.com/janlancer janlancer (@janlancer)

    Hey, Thanks for this post.
    I’m having a problem locating this backdoor .pif file. I followed everything up to step 8. After that I couldn’t locate the .pif file. Will you help me?

    • http://www.piratelufi.com lufi

      it might just mean that you don’t have the backdoor

    • reagan

      hello im having problem locating the .pif file ..if there is no such file in my pc..then why ,everytime i insert a flash drive the same thing happens?

      • http://www.piratelufi.com lufi

        check out the update reagan :D

  • Frost

    I cant locate the .pif file.Proces Explorrer doesnt show any .pif files,and temp folder doesnt contain any of these files.But after reinserting flash drive,it is infected again. :(

    • http://www.piratelufi.com lufi

      Check out the update mr frost :D

    • Zolo

      and this comment is helpful how?

    • http://www.piratelufi.com lufi

      Isn’t that the old school virus for XP? where you insert the USb .open it in explorer and voila it would become koko crunch?

  • brian

    what do i do if my computer is infected?

  • rensis

    i know that my computer is infected and i cant find those green thingys .i already searched the processes that uses the autorun.inf file and came up with nothing,…i followed your instructions carefully and i missed nothing for sure…what can be the alternative fix besides scanning the whole system??my hard drives are full and it will take too long to scan for those stupid viruses/worms.

    • http://www.piratelufi.com lufi

      You don’t need to scan your whole filesystem. Try scanning the important parts like the temp folder and the windows directory.

  • reagan

    hello lufi man…checked the update ..doesn’t help ….done the whole thing on the tutorial…but every time a memory stick would be plugged…the whole thing starts up all over again..only a shortcut would be found upon opening the flash drive..

    I think that the virus is in my PC..but when i check out the rest of the tutorial on checking the virus on drive C..i found no such .pif file tried it many times…

    i am using the latest avast…but running all the scan results to 0 threats found..
    if you have another way to remove the damn virus..pls. post..thanks in advance….

  • AmirD

    Thanks for your help

  • Pol

    Use “virus total” online to find out if the suspicious file on your hard drive used by the process is the backdoor file. Mine is not a pif file but a cmd file with a different file name and it got a 29/46 detection ratio. Anti virus program sucks. XD

  • marlcarlo

    hey guys i have the same problem.. can anyone suggest me a good anti virus that can deal with the said virus? the instruction is a bit tricky for me because i am not good in dealing with things like this

  • http://www.areatech.lv awp3le

    Hello there. Basically I founded out how to lock and disable this kind of virus to execute again even if you run that shortcut.. I know just for windows 7 32-Bit and windows 7 64-Bit as I’m working for IT/Administrator for my company. Where customers working with my companies computers they don’t know that this kind of shortcut execute virus command line.. And I don’t have time for every single one to explain why and how.. So I Sit down and start searching for it how to disable forever. First thing how you can detect if virus is running. Open task manager. If you are using 64-Bit Win-7 then you have to look for (svchost.exe *32) if you are using 32-Bit Win-7 then you have to look for (wuauclt.exe) and for 64-Bit and 32-Bit (DllHost.exe)

    1. Kill running process svchost.exe *32 for 64-Bit Windows 7
    2. Kill running process wuauclt.exe for 32-Bit Windows 7
    3. Kill All running process’s DllHost.exe for 32-Bit Windows 7 and 64-Bit Windows 7
    4. Open C:\ and if you can find there Temp folder open it.
    5. USE FOLDER AND SEARCH OPTIONS to show all hidden and system protected files and folders.
    6. IF you can find application by name TrustedInstaller.exe then you 100% have infected PC
    7. What you can do.
    —– 1. Leave it.
    —– 2. Right click on TrustedInstaller.exe and then choose Properties
    —– 3. Click on Security Tab and then Click on Edit button.
    —– 4. Next Click on Administrators Group And Check all Deny check boxes
    —– 5. Do the same for Users Group
    —– 6. Then Apply and OK
    —– 7. Restart your PC
    8. You are ready to use your PC to check if your PC is protected Plug in your USB and your folders and files do not turn anymore to one single shortcut. Even if you still have Old infected USB with files you 100% can execute that shortcut because we blocked TrustedInstaller.exe to run virus again…

    So best of luck and hope I helped someone :)

    Best regards awp3le..

      • awp3le

        because. If in my case customer run that usb shortcut command again then trustedinstaller regenerates again. and no it is not the same one win. up. use another one. More update for it. TrustedInstalled creates new folder For now TMP .. I. coded Tool that puts Instaler in blockand do not alow for executing it. I will post my app if some one ask.

      • http://www.areatech.lv awp3le

        For now it is good method to use 30 days kaspersky trial. It detect this kinds of thing but also there is problem, with hidden files in USB as Hidden exe or whatever, kaspersky is not detecting it, till you make it visible.. I did program a small tool for WIN8 WIN7/32-63 you can fix your USB after that Kaspersky do rest of the job. If you need it, PM me..

  • busha

    cool! Thanks for the info :)

  • John

    Has anyone lost any files from this virus? I seem to have lost the first folder on my USB stick. I double clicked the shortcut, got to my contents, everything else seems to be there. So I most likely picked this up from an infected computer? Does formatting the USB solve the problem? I don’t have the ability to follow the steps (only have access at computer cafes) and I just want to try to avoid the bad computer. Is it infected as soon as you put it in an affected computer? Thanks for all the help.

  • kandis

    Just use Comand Line, paste that attrib line, delete schorcut and .exe file, scan with AVAST your PC, restart PC and your’re ready to go :).

  • kandis

    This method didn’t help me. Event after deleting all the files. Got serious autorun virus. AVIRA can’t find it. All 4 USB pens are infected. Tried all anti-autorunvirus programs. Not a single could solve it.

  • HK

    I Just got i simple method to remove this nasty virus.

  • HK

    First you just download Malwarebytes Anti-Malware. It free. Then you run that software. Next, you just quick scan your computer by using that software. It will detect all this nasty virus that cause this kind of shortcut. Then, you delete the virus and restart your computer. Done. Hope it is useful.Thanx

  • http://gravatar.com/dnylpz dnylpz

    how much damage can it does to win 8?

  • Rahman Noor

    Thank u Lufi. i was stuck with this virus fore two days, Thanks to your post , I followed the process accordingly and gor rid of this freaky virus, thank you very much

  • Bilzzzzzzzzzz…..

    Thanks….
    It works…

  • https://www.facebook.com/xerxes.parsi Amir Muhammad Mousavi

    Hey Guys, there is an application that I’ve just created for removing virus from your PC and USB.
    Note: Run the application as administrator.
    Note: The application only works on Windows 8 64bit, Windows 7 32&64bit and windows XP SP3.

  • Fiqh as_Sabil

    alhamdulillah…. it’s WORKS..!!!

  • Saleem Hassan

    Hy guys install avast antivirus and scan your full system your problem removed thanks
    03022234075 contact me for more help