View original (French)

USB keys: My files transformed into screensaver format HELP

liahhh Posted messages 45 Status Member -  
 ivheiv -
I had a little problem with my USB key. When I plug it into my PC, the files are transformed into a screensaver. This started after I was at a cybercafé and plugged my key into one of the PCs; I think there was a virus that spread. Moreover, when I plug my USB drive into another PC, the files are completely unreadable, such as photos, videos, etc. I searched the internet about this problem but found nothing. If someone could please help, I really need to recover all my files in good condition.

19 answers

  1.
    billmaxime Posted messages 50523 Registration date   Status Contributor Last intervention   6 150
     
    Hi Liahhh,

    when you retrieve your photos, put them in another folder than your USB key to

    see if you can view them

    see you later

    --
    the radiation level is higher at Pôle Emploi than at Chernobyl
    1
    1. liahhh Posted messages 45 Status Member
       
      When I plug my USB drive into another PC, there’s a folder named: RECOVERY. And when I click on it, this is what appears; https://www.cjoint.com/c/CGeb0NrgeTl

      I’m really disappointed!!! I’m afraid of losing all my data and I want to recover it in good condition as it was.
      0
  2. g3n-h@ckm@n Posted messages 14350 Status Member 949
     
    Hello

    ▶ Download UsbFix (created by El Desaparecido) on your Desktop.

    ▶ If your antivirus alerts, ignore it and temporarily disable the antivirus.
    ▶ Connect all your external data sources to your PC (USB flash drive, external hard drive, etc...) without opening them.
    ▶ Double-click on UsbFix.exe. (for Windows Vista, Windows 7, Windows 8 users, right-click => run as administrator"

    ▶ Click on [Removal].
    ▶ Let the tool work.

    ▶ At the end of the scan, a report will be displayed, post it in your next reply on the forum.

    ▶ The report is also saved at the root of the system drive ( C:\UsbFix.txt ).

    --
    ¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
    Windows 8 => same thing as Vista X 10
    0
    1. liahhh Posted messages 45 Status Member
       
      Thank you for your help. I finally managed to read my files in a normal format, only one small issue: 4 of my files are there, but when I click on them it says "empty folder." I tried deleting one that wasn't necessary and it showed how many photos would be deleted, so I quickly canceled the deletion... One last favor, please?
      0
    2. juju666 Posted messages 35446 Registration date   Status Security Contributor Last intervention   4 796
       
      Hi, please post the report...
      0
    3. liahhh Posted messages 45 Status Member
       
      I wanted to save it but I exited by accident... I found a program to download to recover my lost files. But I have a big problem, I have no internet on my PC, not even wireless networks, nothing shows up since I used the program you advised me to download, all while clicking on "delete". When I connect on my phone with wireless network the connection works normally but not on my PC!!!

      I go to connect to a network and they tell me "no connection". I'm now using my internet cable! No wireless networks appear what should I do ????
      0
    4. ivheiv
       
      [b]############################## | UsbFix V 8.248 | [Cleaning][/b]

      User: Ijja (Administrator) # LENOVO-PC-IJJA
      Updated on 27/05/2016 by SOSVirus
      Launched at 18:24:58 | 30/05/2016

      Website: [url=http://www.usb-antivirus.com/fr/]http://www.usb-antivirus.com/fr/[/url]
      Tutorial: [url=http://www.sosvirus.net/tutoriel-usbfix/]http://www.sosvirus.net/tutoriel-usbfix/
      Assistance: [url=http://www.sosvirus.net/]http://www.sosvirus.net/
      Live Detection: [url=http://www.sosmalware.com/fr/usbfix/]http://www.sosmalware.com/fr/usbfix/
      Contact: [url=http://www.usb-antivirus.com/fr/contact/]http://www.usb-antivirus.com/fr/contact/

      [b]################## | System information |[/b]

      MB: LENOVO (Lenovo G505s)
      CPU: AMD A8-4500M APU with Radeon(tm) HD Graphics
      GC: AMD Radeon HD 7640G
      RAM -> [Total: 3279 MB | Free: 2099 MB]
      Bios: LENOVO
      Boot: Normal boot

      OS: Microsoft™ Windows 8.1 (6.3.9600 64-Bit)
      WB: Internet Explorer : 11.00.9600.16384
      WB: Mozilla Firefox : 46.0.1

      [b]################## | Security Information |[/b]

      AV: Windows Defender [[b](!) Disabled[/b] |Up-to-date]
      AV: avast! Antivirus [Active |Up-to-date]
      AS: Windows Defender [[b](!) Disabled[/b] |Up-to-date]
      AS: avast! Antivirus [Active |Up-to-date]
      FW: Windows Firewall [Active]
      SC: Security Center [Active]
      WU: Windows Update [Active]

      [b]################## | Disk Information |[/b]

      C:\ (%SystemDrive%) -> Fixed disk # 893 GB (722 GB free - 81%) [Windows8_OS] # NTFS
      D:\ -> Fixed disk # 25 GB (22 GB free - 90%) [LENOVO] # NTFS
      F:\ -> Removable disk # 7 GB (7 GB free - 96%) [] # NTFS

      [b]################## | Generic search |[/b]

      Deleted! F:\Anglais .scr
      Deleted! F:\COMNEGO .scr
      Deleted! F:\DROIT .scr
      Deleted! F:\Francais .scr
      Deleted! F:\Gaudry .scr
      Deleted! F:\SARAH projet .scr
      Deleted! F:\TD_prospection_climatisation .scr
      Deleted! F:\Thumbs .db
      Deleted! F:\Thumbs.com
      Restored! [D] F:\Anglais
      Restored! [D] F:\COMNEGO
      Restored! [D] F:\DROIT
      Restored! [D] F:\Francais
      Restored! [D] F:\Gaudry
      Restored! [D] F:\SARAH projet
      Restored! [D] F:\TD_prospection_climatisation

      (!) Temporary files deleted. (9263.99868869781 MB)

      [b]################## | Startup |[/b]

      F2 - HKLM\..\Winlogon : [Shell] explorer.exe
      F2 - [x64] HKLM\..\Winlogon : [Shell] explorer.exe
      F2 - HKLM\..\Winlogon : [Userinit] userinit.exe
      F2 - [x64] HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
      04 - HKLM\..\Run : [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
      04 - HKLM\..\Run : [Lenovo App Shop] "C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\ismagent.exe" --domain-id F0399437-FD0C-4A48-B101-F0314A6172E4
      04 - HKLM\..\Run : [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
      04 - HKLM\..\Run : [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
      04 - HKLM\..\Policies\Explorer\run : [BtvStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
      04 - [x64] HKLM\..\Run : [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe
      04 - [x64] HKLM\..\Run : [SmartAudio] C:\Program Files\CONEXANT\SAII\SACpl.exe /t
      04 - [x64] HKLM\..\Run : [ETDCtrl] %ProgramFiles%\Elantech\ETDCtrl.exe
      04 - [x64] HKLM\..\Run : [RtsFT] RTFTrack.exe
      04 - [x64] HKLM\..\Run : [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
      04 - [x64] HKLM\..\Run : [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe
      04 - [x64] HKLM\..\Policies\Explorer\run : [BtvStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"

      [b]################## | C:\ %SystemDrive% - Fixed Disk (NTFS) |[/b]

      [29/05/2016 - 21:32:18 | ASH | 2686368 KB] - C:\hiberfil.sys
      [29/05/2016 - 21:32:21 | ASH | 589824 KB] - C:\pagefile.sys
      [29/05/2016 - 21:32:21 | ASH | 262144 KB] - C:\swapfile.sys
      [30/01/2014 - 20:02:54 | A | 4977 KB] - C:\setup.dll
      [18/03/2014 - 21:22:14 | SHD] - C:\$Recycle.Bin
      [07/10/2013 - 21:23:11 | RASH | 8 KB] - C:\BOOTSECT.BAK
      [03/01/2016 - 18:20:18 | SHD] - C:\found.000
      [29/05/2016 - 22:40:22 | D] - C:\$WINDOWS.~BT
      [18/06/2013 - 14:18:29 | N | 0 KB] - C:\BOOTNXT
      [22/08/2013 - 16:45:52 | SHD] - C:\Documents and Settings
      [22/08/2013 - 17:22:35 | D] - C:\PerfLogs
      [29/09/2013 - 10:04:26 | RASH | 389 KB] - C:\bootmgr
      [07/10/2013 - 20:40:53 | SHD] - C:\Boot
      [24/12/2013 - 19:58:54 | D] - C:\UserGuidePDF
      [18/03/2014 - 21:15:45 | AD] - C:\Users
      [18/03/2014 - 21:42:15 | D] - C:\drivers
      [20/01/2015 - 19:52:56 | D] - C:\3e60f3ca5423b5aa707f542d495f35
      [18/03/2015 - 23:40:03 | HD] - C:\ProgramData
      [20/03/2016 - 12:47:25 | RD] - C:\Program Files
      [06/05/2016 - 22:28:54 | D] - C:\4fde202132f74d9f0be5fdff00ea6ccf
      [08/05/2016 - 21:32:56 | RD] - C:\Program Files (x86)
      [29/05/2016 - 19:22:36 | AD] - C:\WINDOWS
      [29/05/2016 - 22:32:01 | SHD] - C:\Recovery
      [30/05/2016 - 18:19:11 | D] - C:\UsbFix

      [b]################## | D:\ - Fixed Disk (NTFS) |[/b]

      [18/03/2014 - 21:31:15 | SHD] - D:\$RECYCLE.BIN
      [24/12/2013 - 19:49:49 | D] - D:\Application
      [24/12/2013 - 20:15:04 | D] - D:\drivers
      [22/03/2014 - 20:37:51 | D] - D:\Lenovo

      [b]################## | F:\ - USB Disk (NTFS) |[/b]

      [05/04/2016 - 11:58:34 | D] - F:\Anglais
      [14/03/2016 - 14:48:03 | HD] - F:\boot
      [13/05/2016 - 08:51:59 | D] - F:\COMNEGO
      [15/01/2008 - 09:45:12 | A | 66,237 KB] - F:\CS 1.6 (Portable).exe
      [19/04/2016 - 12:31:10 | A | 20 KB] - F:\CV Sarah ZAOUG le hamel.odt
      [19/04/2016 - 10:48:27 | A | 10 KB] - F:\CV Sarah ZAOUG.odt
      [13/05/2016 - 08:52:22 | D] - F:\DROIT
      [09/05/2016 - 11:27:52 | A | 26 KB] - F:\Etude quantitative.docx
      [24/05/2016 - 09:55:57 | A | 229 KB] - F:\fiche medecin traitant.pdf
      [14/03/2016 - 14:48:55 | D] - F:\Francais
      [27/05/2016 - 11:14:48 | D] - F:\Gaudry
      [27/05/2016 - 11:53:10 | D] - F:\SARAH projet
      [15/03/2016 - 14:50:35 | D] - F:\TD_prospection_climatisation
      [04/04/2016 - 14:25:55 | A | 191 KB] - F:\Anglais\YIREGO.pptx
      [26/08/2014 - 18:11:27 | ASH | 17 KB] - F:\boot\bcd.LOG
      [26/08/2014 - 18:11:26 | ASH | 0 KB] - F:\boot\bcd.LOG1
      [26/08/2014 - 18:11:26 | ASH | 0 KB] - F:\boot\bcd.LOG2
      [09/05/2016 - 20:28:19 | A | 462 KB] - F:\COMNEGO\Carte de visite.odt
      [09/05/2016 - 21:49:50 | A | 16 KB] - F:\COMNEGO\Plan de découverte.docx
      [29/03/2016 - 17:25:39 | A | 20 KB] - F:\DROIT\chapdroit.docx
      [12/04/2016 - 17:01:04 | A | 18 KB] - F:\DROIT\Chapitre 3.docx
      [06/03/2016 - 16:49:34 | A | 11 KB] - F:\Francais\Ecriture personnelle.odt
      [27/01/2016 - 19:31:48 | A | 454 KB] - F:\Gaudry\001.jpg
      [27/01/2016 - 19:33:46 | A | 546 KB] - F:\Gaudry\002.jpg
      [01/02/2016 - 13:43:01 | A | 733 KB] - F:\Gaudry\Argumentaire tarification.pptx
      [11/04/2016 - 17:27:17 | A | 1083 KB] - F:\Gaudry\argumentaire traceur.pptx
      [01/02/2016 - 13:42:07 | A | 14 KB] - F:\Gaudry\excel tarif.xlsx
      [18/01/2016 - 18:12:04 | A | 286 KB] - F:\Gaudry\Tarif heure pleine.pptx
      [09/05/2016 - 21:48:58 | A | 22 KB] - F:\SARAH projet\carte de visite.odt
      [16/02/2016 - 16:02:41 | A | 11 KB] - F:\SARAH projet\infos Christophe.docx
      [07/03/2016 - 14:18:57 | A | 67491 KB] - F:\SARAH projet\KEZAKO_ Comment fonctionne un GPS_.mp4
      [09/05/2016 - 20:17:26 | A | 455 KB] - F:\SARAH projet\lostnfound_logo.jpg
      [27/05/2016 - 11:51:45 | A | 6906 KB] - F:\SARAH projet\projet-présentable.pptx
      [08/03/2016 - 14:46:52 | A | 6159 KB] - F:\SARAH projet\Trame infos.pptx
      [08/03/2016 - 14:47:47 | A | 5486 KB] - F:\SARAH projet\Trame mal fait.pptx
      [11/02/2016 - 16:46:10 | AH | 0 KB] - F:\SARAH projet\~$Trame_projet .pptx
      [24/11/2015 - 15:07:02 | A | 12 KB] - F:\TD_prospection_climatisation\BDDTD.xlsx
      [24/11/2015 - 16:44:18 | A | 15 KB] - F:\TD_prospection_climatisation\GET.docx
      [24/11/2015 - 17:58:53 | A | 455 KB] - F:\TD_prospection_climatisation\lettretype.docx
      [24/11/2015 - 17:58:46 | A | 467 KB] - F:\TD_prospection_climatisation\PUBLIPOSTAGE.docx

      [b]################## | Vaccine |[/b]

      C:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
      D:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
      F:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)

      [b]Analysis completed in 504.0 seconds[/b]

      [b]################## | E.O.F | [url=http://www.sosvirus.net/]http://www.sosvirus.net/[/url] | [url=http://www.usb-antivirus.com/fr/]http://www.usb-antivirus.com/fr/[/url] |[/b]
      0
  3. g3n-h@ckm@n Posted messages 14350 Status Member 949
     
    Can I have the report?

    it’s there:

    C:\usbfix [Clean 1].txt

    --
    ¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
    Windows 8 => same flop as Vista X 10
    0
    1. liahhh Posted messages 45 Status Member
       
      I understand, but if you give me the report, what else could you do?
      0
  4. g3n-h@ckm@n Posted messages 14350 Status Member 949
     
    not understood the question

    --
    ¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
    Windows 8 => same flop as Vista X 10
    0
    1. liahhh Posted messages 45 Status Member
       
      Sorry, I misspoke, I found 3 reports including;

      UsbFix [Clean 2] SOUSOU-PC
      UsbFix [Clean 3] SOUSOU-PC
      UsbFix [Clean 4] SOUSOU-PC
      0
  7. liahhh Posted messages 45 Status Member
     
    There’s only the ;

    UsbFix [Clean 2] SOUSOU-PC
    UsbFix [Clean 3] SOUSOU-PC
    UsbFix [Clean 4] SOUSOU-PC

    But I can’t find the 1, should I still give it to you anyway ?
    0
  8. g3n-h@ckm@n Posted messages 14350 Status Member 949
     
    send the 3 via cjoint.com and provide the links to view them

    --
    ¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
    Windows 8 => same flop as Vista X 10
    0
  9. g3n-h@ckm@n Posted messages 14350 Status Member 949
     
    look if you can remove this:

    D:\vedw.exe
    E:\autoply.exe

    --
    ¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
    Windows 8 => the same flop as Vista X 10
    0
    1. liahhh Posted messages 45 Status Member
       
      There is marked:

      This action cannot be performed because the file is open in the vedw, close the file and try again.

      And for the other it says the specified reader is not found.
      0
    2. liahhh Posted messages 45 Status Member
       
      There you go, I managed to delete "vedw" but the other one is unfindable
      0
  10. g3n-h@ckm@n Posted messages 14350 Status Member 949
     
    redo the listing option with usbfix

    --
    ¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
    Windows 8 => same flop as Vista X 10
    0
    2. afideg Posted messages 10466 Registration date   Status Security Contributor Last intervention   602
       
      Hello Gen
      Cédric has now found the trick to fill the treasury of his estate! ;)
      Ha! These Bretons!
      Al.
      0
  11. billmaxime Posted messages 50523 Registration date   Status Contributor Last intervention   6 150
     
    hello liahhh

    have you run Drweb on your PC?



    https://free.drweb.fr/cureit/

    see you
    --
    the radiation rate is higher at Pôle Emploi than at Chernobyl
    0
    1. liahhh Posted messages 45 Status Member
       
      Thank you for your help. The only issue now is that when I plug in my USB key certain photos are deleted from the folder and when I recover my lost photos with software and put them back into the folder I’m told they are already there even though I don’t see them, they’re probably in transparency, what can I do???
      0
  12. billmaxime Posted messages 50523 Registration date   Status Contributor Last intervention   6 150
     
    hi liahhh,

    on the key, given the image you posted, it’s 1 copy of the recovery partition>>>>

    which must also be found in Disk Management

    ps: make sure you indeed have this partition in your Disk Management and do not delete anything on your key for now

    see you later

    --
    the radiation rate is higher at Pôle Emploi than at Chernobyl
    0
  13. g3n-h@ckm@n Posted messages 14350 Status Member 949
     
    Plug in anything that can connect to your USB ports (flash drive, external disk, SD card too, MP3, etc.)

    download here:

    http://www.security-helpzone.com/Tools/g3n/Load_SalityKiller.exe

    Disable your protections

    launch it, click on start cleaning

    At the end SalityKiller.txt will appear on your desktop

    DO NOT POST IT ON THE FORUM (it's too long)

    right-click it, send to, compressed (zipped) folder

    then:

    host the archive at http://pjjoint.malekal.com and share the obtained link

    ¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
    Windows 8 => same flop as Vista X 10
    0
    1. liahhh Posted messages 45 Status Member
       
      Hello, I did what you told me, I waited patiently for the cleaning to finish, but on my desk there is a notebook named "log" and 3 other files transparent like that that appeared.. I managed to recover my lost photos but they are transparent, is that normal ???
      0
  14. billmaxime Posted messages 50523 Registration date   Status Contributor Last intervention   6 150
     
    yo men

    @+

    --
    the radiation rate is higher at unemployment office than at Chernobyl
    0
    1. g3n-h@ckm@n Posted messages 14350 Status Member 949
       
      :)

      Scr on USB gave me the sudden spark, Sality, all at once :)
      0
  15. liahhh Posted messages 45 Status Member
     
    Pffffffffffff --" !!!! I plugged in my USB keys incorrectly!! It’s stupid, yes I know :/ Thanks anyway for your help! Well I can read my files correctly now, only I noticed that some photos disappeared and as I said here a bit earlier I had downloaded a software to recover my lost photos, and when I move my recovered photos into the folder they say that those photos or folders are already there, whereas when I click on the file it says "empty folder" I think some of the missing photos are in transparency, any solution?
    0
  16. billmaxime Posted messages 50523 Registration date   Status Contributor Last intervention   6 150
     
    Hi Liahhh,

    have you done what Gen recommends in this message?

    https://forums.commentcamarche.net/forum/affich-28117152-cles-usb-mes-fichiers-transforme-en-format-ecran-de-veille-help#30

    See you later.

    --

    the radiation rate is higher at Pôle Emploi than at Chernobyl
    0
  17. billmaxime Posted messages 50523 Registration date   Status Contributor Last intervention   6 150
     
    re

    there, we will have to wait for Gen to tell you what to do

    see you later

    --
    the radiation rate is higher at Pôle Emploi than at Chernobyl
    0
  18. g3n-h@ckm@n Posted messages 14350 Status Member 949
     
    re

    if you delete the log, and you redo salitykiller ?

    --
    ¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
    Windows 8 => the same flop as Vista X 10
    0
    1. liahhh Posted messages 45 Status Member
       
      I redid it several times but still the same result.
      0
    2. liahhh Posted messages 45 Status Member
       
      There is always this notepad on my desk "log" that keeps popping up.
      0
  19. g3n-h@ckm@n Posted messages 14350 Status Member 949
     
    well yes but I’d like to read it, is it normal that it returns, it’s the result of the scan

    --
    ¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
    Windows 8 => same flop as Vista X 10
    0
    1. liahhh
       
      03:01:19:907 4388 scanning threads ...
      03:01:59:293 4388
      03:01:59:294 4388 scanning processes ...
      03:02:00:833 4388
      03:02:00:834 4388 Restoring show hidden and system files
      03:02:00:835 1292
      Monitoring thread started
      03:02:00:848 4388
      03:02:00:850 4388 restoring SafeBoot registry node
      03:02:00:850 4388
      03:02:00:851 4388 fixing registry ...
      03:02:00:866 4388 SalityRegCure: Restoring general registry keys
      03:02:00:942 4388 SalityRegCure: Fixing system.ini
      03:02:00:943 4388
      03:02:00:944 4388 scanning drives ...
      03:02:00:945 4388 scanning C:\ ...
      03:37:05:573 4388 scanning D:\ ...
      03:37:47:561 4388 scanning E:\ ...
      03:42:31:471 4388 scanning G:\ ...
      03:42:34:841 4388
      03:42:34:842 1292
      Monitoring thread stopped
      03:42:34:933 4388
      completed
      03:42:34:953 4388 Infected files: 0
      03:42:34:953 4388 Infected processes: 0
      03:42:34:954 4388 Infected threads: 0
      03:42:34:954 4388 Cured files: 0
      03:42:34:954 4388 Will be cured on reboot: 0
      03:42:34:954 4388 Executed registry scripts: 1
      0
  20. g3n-h@ckm@n Posted messages 14350 Status Member 949
     
    re

    toujours ton souci ?

    --
    ¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
    Windows 8 => meme flop que Vista X 10
    0