LebGeeks

Nabs

Member

Restoring locked file attributes after VBS virus removal

Some of the young trainees have been having issues with a virus called Desktop.vbs or Cool.vbs... The name changes, but it's a vbs file that infects Windows, and turns files and folders on removable devices into protected system files and hides them, and places copies of fake shortcuts with the same names as those files and folders.

The removal of this virus is very simple. Almost any updated antivirus can nail it. But if the damage has already been done, you will have lots of files that have turned into protected system files. They will be hidden, and showing transparent icons. The properties tab shows that they are locked.

To restore them into original state, go to elevated CMD, and type:
attrib -s -h -r DRIVERLETTER:/*.* \s \d

Voila, all files look normal again.
Thought I'd share this with you, in case anyone was doing what the trainees have been doing - create folders, copy contents, delete original folders and rename new folders. HASSLE.