Help for USB wiped by virus
- vladimir
- Feminist Watch List
- Reactions: 4
- Posts: 34235
- Joined: Thu Sep 23, 2004 7:43 am
- Location: mod edit
Help for USB wiped by virus
I found this, helped me recover 12GB of important stuff from a USB that had been hit by malware: Hope it will be useful to someone, it works really well.
Do the following :
1. Open a new text document in the flash drive
2. Enter the following code in the text document:
@echo off
attrib -s -h -r /s /d
cls
exit
3. Click File - Save as
4. Save it as "unhide.bat"
5. Close and delete the new text document
6. Double click on the "unhide" batch file
7. A black command screen will pop up and close
Do the following :
1. Open a new text document in the flash drive
2. Enter the following code in the text document:
@echo off
attrib -s -h -r /s /d
cls
exit
3. Click File - Save as
4. Save it as "unhide.bat"
5. Close and delete the new text document
6. Double click on the "unhide" batch file
7. A black command screen will pop up and close
ירי ילדים והפצצת אזרחים דורש אומץ, כמו גם הטרדה מינית של עובדי ההוראה.
That code shows hidden files. You will need to scan your USB and computer with virus software because whatever made them hidden is still present.
pew, pew, pew, pew!
-
- Damn, I just saw my Internet Bill !
- Reactions: 4
- Posts: 4384
- Joined: Fri Sep 05, 2014 5:46 am
Never write on media that you are attempting data recovery on. Never ever. It is the absolute worse practise.
The first thing you should do is image the drive.
Then rebuild the data from the image leaving the original drive safe.
The ignorance shown in the OP is huge given the batch command is only performing one task which can be just as easily performed at the command prompt and is also irrelevant. It will not by any chance recover, or aid in the recovery of deleted (wiped) data. It will only change the attributes of files present in the FAT.
I curse tapatalk for showing posts of people in my foes list but this ignorance is upsetting.
Never write on the drive you want to recover data from as you may write over the data you want to recover.
No wonder the op has so many computer problems if he runs batch command he finds on Google with no idea what they do.
The first thing you should do is image the drive.
Then rebuild the data from the image leaving the original drive safe.
The ignorance shown in the OP is huge given the batch command is only performing one task which can be just as easily performed at the command prompt and is also irrelevant. It will not by any chance recover, or aid in the recovery of deleted (wiped) data. It will only change the attributes of files present in the FAT.
I curse tapatalk for showing posts of people in my foes list but this ignorance is upsetting.
Never write on the drive you want to recover data from as you may write over the data you want to recover.
No wonder the op has so many computer problems if he runs batch command he finds on Google with no idea what they do.
"the op"
Can't you bring yourself to mention his name?
Can't you bring yourself to mention his name?
pew, pew, pew, pew!
I'd agree with this advice, but wouldn't quite equate running the attrib command to data recovery.Gin&Tonic wrote:Never write on media that you are attempting data recovery on. Never ever. It is the absolute worse practise.
Also, there may be viruses out there that set files to be hidden, but I'd think it would be just as likely to be some kind of mistake.
Touched by His Noodly Appendage
vlad does Windows.
vlad - install a version Ubuntu on any old computer, plug in the thumb drive, then copy out the files. 99% chance that will work.
Top menu - view hidden files - before you copy.
Don't copy out anything you don't recognise.
Check you've got what you need and then reformat the thumb drive.
Recopy the old files back to the thumb drive again.
Then go back to the school computers and re-infect the drive with another virus.
vlad - install a version Ubuntu on any old computer, plug in the thumb drive, then copy out the files. 99% chance that will work.
Top menu - view hidden files - before you copy.
Don't copy out anything you don't recognise.
Check you've got what you need and then reformat the thumb drive.
Recopy the old files back to the thumb drive again.
Then go back to the school computers and re-infect the drive with another virus.
-
- Damn, I just saw my Internet Bill !
- Reactions: 4
- Posts: 4384
- Joined: Fri Sep 05, 2014 5:46 am
Irrelevant as you know. Windows hides files with an attribute. *nix simply adds a period as a prefix to the filename. What is hidden in one won't be in the other and vice versa.Chuangt2u wrote: Top menu - view hidden files - before you copy.
- vladimir
- Feminist Watch List
- Reactions: 4
- Posts: 34235
- Joined: Thu Sep 23, 2004 7:43 am
- Location: mod edit
Yeah, guys, I did kind of realise that the USB was hit by a virus/malware. This happened when it was plugged it into a work desktop.
And yes,Yating, I do understand that the USB should be scanned; it was, with antivirus and Malwarebytes. The remedy worked 100%, all files recovered, no virus or malware on my laptop.
The files would be visible if the virus/malware was not present.
The remedy works. No adverse effects. End of.
And yes,Yating, I do understand that the USB should be scanned; it was, with antivirus and Malwarebytes. The remedy worked 100%, all files recovered, no virus or malware on my laptop.
The files would be visible if the virus/malware was not present.
The remedy works. No adverse effects. End of.
ירי ילדים והפצצת אזרחים דורש אומץ, כמו גם הטרדה מינית של עובדי ההוראה.
Vlad, the remedy worked in your case, but your method will make full recovery impossible in many other cases. It's like G&T said, never write on a medium you want to recover. By saving this text file / batch file on the USB you overwrite memory Windows considers to be free space, and after the writing the original data stored there can NEVER be recovered. The problem is your data might still be there, but the virus just makes Windows believe it's a free space. This has to to with the lazy way Windows' computers manage files.vladimir wrote:Yeah, guys, I did kind of realise that the USB was hit by a virus/malware. This happened when it was plugged it into a work desktop.
And yes,Yating, I do understand that the USB should be scanned; it was, with antivirus and Malwarebytes. The remedy worked 100%, all files recovered, no virus or malware on my laptop.
The files would be visible if the virus/malware was not present.
The remedy works. No adverse effects. End of.
You could overcome this problem / risk by saving the batch file on another drive and address the files you want to change the attribute of with a path. That said, your method will only work with malware that just changes the attribute of files to hidden. Those 'malwares' can hardly be called malware actually....
And one addition: there's no 'law' your method will work if you can't find your files on your USB stick / memory, you were just plain lucky. If, for instance, the malware didn't just change the attribute but actually deleted the files in the FAT your method will prevent a full recovery and do harm without any positive effects whatsoever.
- vladimir
- Feminist Watch List
- Reactions: 4
- Posts: 34235
- Joined: Thu Sep 23, 2004 7:43 am
- Location: mod edit
Thanks, Kachang.Kachang wrote:And one addition: there's no 'law' your method will work if you can't find your files on your USB stick / memory, you were just plain lucky. If, for instance, the malware didn't just change the attribute but actually deleted the files in the FAT your method will prevent a full recovery and do harm without any positive effects whatsoever.
I did check before running the remedy, by clicking on properties. The amount used on the disk showed me that the files still existed but could not be read.
I then ran the remedy.
ירי ילדים והפצצת אזרחים דורש אומץ, כמו גם הטרדה מינית של עובדי ההוראה.
No, I don't think he's trolling, there's actually loads of PC's in Phnom Penh suffering from this 'malware' changing attributes to hidden. I had one SD-card once that had this problem too after bringing some files to a print shop. I also think many people don't have clue what to do in case it happens to them. This thread clearly shows - doesn't it?Gin&Tonic wrote:Why would you create a batch file for running one command?
It would be far quicker and easier to run from a dos prompt or even easier still change the attributes from Windows explorer.
The op is trolling. This thread is ridiculous.
And indeed, there's no need to make a batch file, it can be run from the command line, but the OP clearly doesn't know (much) about the commandline, and its commands, since 3 commands out 4 the OP used don't do anything useful. In fact, the last one makes it even impossible to view the results of the only command that matters here.
-
- Similar Topics
- Replies
- Views
- Last post
-
-
Buy hardwood during Corona virus?
by Guest999 » Sun Oct 04, 2020 2:15 am » in Houses, Apartments and Real Estate - 9 Replies
- 3195 Views
-
Last post by Guest999
Fri Oct 16, 2020 12:56 am
-
-
- 10 Replies
- 1735 Views
-
Last post by techietraveller84
Thu Jan 14, 2021 7:52 am
-
- 78 Replies
- 18036 Views
-
Last post by spitthedog
Sun Aug 30, 2020 6:28 pm
-
- 72 Replies
- 9188 Views
-
Last post by v12
Tue Sep 01, 2020 2:54 pm
-
-
What is the general feeling these days in Cambodia concerning the covid virus?
by horace » Sun Jul 26, 2020 9:10 pm » in Cambodia Speakeasy - 18 Replies
- 3671 Views
-
Last post by Miguelito
Tue Jul 28, 2020 10:59 am
-