Avast WEBforum

Business Products => Archive (Legacy) => Avast Business => Avast Distributed Network Manager => Topic started by: FLEURS200 on May 31, 2011, 12:29:43 PM

Title: WORMS CREATING A SHORTCUT ON WORKSTATIONS AND HIDING ORIGINAL DOCUMENTS
Post by: FLEURS200 on May 31, 2011, 12:29:43 PM

Hi all,
we are facing some issues on our network and it is going out of hand.
There are creation of shortcuts of on our workstations and the original files are being hiding. Avast was able to detect some worms after boot scan, but we cant get our documents.
We kindly need our help.
Paulin

Title: Re: WORMS CREATING A SHORTCUT ON WORKSTATIONS AND HIDING ORIGINAL DOCUMENTS
Post by: Lisandro on May 31, 2011, 01:44:57 PM

Maybe the infection was cleaned but the action taken by the virus weren't reverted.
Can you check the access rights in that particular folder?

Title: Re: WORMS CREATING A SHORTCUT ON WORKSTATIONS AND HIDING ORIGINAL DOCUMENTS
Post by: Jan Nabelek on June 01, 2011, 07:48:37 PM

Quote from: KAPRUNO on May 31, 2011, 12:29:43 PM

...but we cant get our documents.

Restore your documents from backup... if any :-)
If no backup exist, try Undelete programs like Restoration. But your chance seems to be low

Title: Re: WORMS CREATING A SHORTCUT ON WORKSTATIONS AND HIDING ORIGINAL DOCUMENTS
Post by: wpn on June 02, 2011, 12:56:48 PM

well you mention yourself that the virus created shortcuts

are you using THOSE shortcuts or do you try to access the files directly from the location they are stored?? if its via the shortcuts delete all the shorts and make new ones yourself if you used them...


else there is no other way then go back to a backup from BEFORE the infection

Title: Re: WORMS CREATING A SHORTCUT ON WORKSTATIONS AND HIDING ORIGINAL DOCUMENTS
Post by: traix on June 07, 2011, 12:03:48 PM

Generally, the files are just hidden, changing properties in the the document and settings files should solve the problem

Title: Re: WORMS CREATING A SHORTCUT ON WORKSTATIONS AND HIDING ORIGINAL DOCUMENTS
Post by: Trini Boom on June 08, 2011, 04:19:17 PM

Quote from: traix on June 07, 2011, 12:03:48 PM

Generally, the files are just hidden, changing properties in the the document and settings files should solve the problem

Actually, it does not solve the problem. I had this issue on a client external hard drive and it was not discoverable until you unchecked "Hide Protected Operating System Files" for the real folders to be discovered. There is no way to convert the existing folder back into regular files. You have to create a new folder and copy the contents out into the new folder created to get it back to normal.

Title: Re: WORMS CREATING A SHORTCUT ON WORKSTATIONS AND HIDING ORIGINAL DOCUMENTS
Post by: .: Mac :. on June 14, 2011, 01:41:19 PM

I have had this happen before. There are many applications that can change the attribute on multiple files/folders at one to correct this. Here is one such app:
http://www.snapfiles.com/get/achanger.html

Also as the others have said, make sure you make regular backups of your data. This can not be stressed enough.