Spyware, viruses, & security forum: Recovery of data from External HDD after worm attack

Thanks Carol~,
I have OS WinXP SP3. You are right, I am not able to see the folders. I have already checked "Unhide files & folders" & also removed check mark "Hide protected operating system files". But result is the same.

achaudhuri..

As you may have read in Microsoft's analysis of Dorkbot!lnk, "LNK files detected as Worm:Win32/Dorkbot!lnk are commonly found on removable drives, and are used to launch a Worm:Win32/Dorkbot executable file also found on the drive. If the user tries to open the shortcut file, it launches the worm executable and also opens an Explorer window.". It's just as you described.

Prior to making any further recommendations, I think it would be important to make sure your A/V completed the job. And also to be assured there is nothing else "lurking around". Try the below (free) tools..

• Autorun Eater - You can read the developer's description of it here. See their FAQ if you have any questions. Autorun Eater v2.6 can be downloaded here.

• Malwarebytes' Anti-Malware - http://www.malwarebytes.org/products/malwarebytes_free

• ESET's Online Scanner - Their FAQ and Help sections should answer any questions you might have. (Temporarily disable your A/V prior to running the scan)

Let us know if there is anything remarkable to report..
Carol

Thanks. I'll give a try

Yesterday, I installed the Quickheal AV with latest virus signature. Scanned the entire PC again with the external HDD. It did not find any. The computer was scanned before with AVG A/V & the HDD too. Still, the files/folders were not visible.
I then ran "uninstall.exe" . It took quite a while. Even at the end it reported the some registry entry repaired. But files/floders were still invisible.
What's next ?????

Did you mean the unhide.exe?

If as you say your antivirus removed it, and you ran Autorun Eater, along with the other scanners, the infection should be gone. Gone with the exception of the damage it did.

I don't know what else to tell you. I don't want to suggest anything drastic, without having you first post at a Malware Removal forum. I've only found a couple which have had success unhiding the files.

If MSE found the threat, I would suggest first posting at their forum. It's not the first time they've dealt with your problem.

Otherwise, here a few other's to choose from:

http://www.bleepingcomputer.com/forums/forum22.html
http://www.spywareinfoforum.com/index.php?/forum/18-malware-removal/
http://forums.malwarebytes.org/index.php?showforum=7
http://aumha.net/viewforum.php?f=30
http://www.geekstogo.com/forum/forum/37-virus-spyware-malware-removal/
http://spywarehammer.com/simplemachinesforum/index.php#3

Lastly, I would warn against trying any "fixes" from unknown sites, unless you have a link scanner such as Web of Trust (WOT) installed. It might only make matters worse.

Best of luck..
Carol

Before closing the door, have a look in our own backyard.

And that would be at the Storage Forum. I may be over-looking the obvious.

Further good luck..
Carol

Ultimately, I got the break !!!
I installed the Malwarebytes' Anti-Malware and ran it. It took more than 10 hrs. to complete and found 3 infected files in my HDD. But the folders were converted to System folder and then when I uncheck the Hide System Files tab, all the After that I could see all the folders (slightly dim as those are still with Hidden attribute) and files in them.
Now, probably, I have to transfer the files manually one by one under newly created folders and delete the old(hidden) folders !!!! Or, there is some other tools to do it automatically ?????
Thanks for the fabulous guidance, Carol !!!

Carol, I am facing same problem as achaudhuri66 has faced. But i have already removed the virus named "Dorkbot.A" & "Dorkbot!Ink" but still I am unable to see my data in the HDD. while i can see the occupied space in HDD as "212GB". Also i can see the folders and files while scanning with Miscrosoft essential. But unable to see any folder in HDD rather it shows RYCLER and a shortcut of SYSTEM VOLUME INFORMATION. Both of them are hidden. Now is there any way to recover my data? Please help me its urgent.

Regards
Kavit Sharma

http://www.howtogeek.com/howto/windows-vista/use-ubuntu-live-cd-to-backup-files-from-your-dead-windows-computer/ might help.