Author Topic: Avast deleted autorun file from external drive, now drive is Inaccessible  (Read 7160 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
Hi. Today I connected my external wd 2.5 drive to the computer and avast send an alert message and erased the autorun.inf file from this drive. After this windows couldn’t access any more to the drive. I went to avast and try to restore the file but it doesn’t do it because there is no access to the drive, because I assume this file was deleted. Please, can someone tell me how to fix this, so to not lose my files? Thank you.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37597
  • Not a avast user
Try this >  https://forum.avast.com/index.php?topic=194892.0

Scroll down to SPECIFIC INFECTIONS LOGS

Follow instructions for MCShield and copy paste the log here





Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31078
  • Watching (over?) you
    • Malware removal, Biljart and other things.
autorun.inf is not needed to access a drive (hd, dvd, cd, usb stick etc)
It is used to automatically run something on that drive.

I very much doubt that file was there legitimately.

Offline stibi

  • Sr. Member
  • ****
  • Posts: 383
Windows? You have access with the Win explorer by opening the appropriate drive ...

REDACTED

  • Guest
Try this >  https://forum.avast.com/index.php?topic=194892.0

Scroll down to SPECIFIC INFECTIONS LOGS

Follow instructions for MCShield and copy paste the log here

I downloaded MCShield and installed it. I followed the instructions and then plug in the drive, but the bellow log does not show a scan to this drive (H). I asume drive H cannot be access by MCShield.



>>> MCShield AllScans.txt <<<

-----------------------------
MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2016.2.21.1 / Windows 7 <<<

1/31/2017 10:52:05 AM > Drive C: - scan started (no label ~98 GB, NTFS HDD )...

=> The drive is clean.

1/31/2017 10:52:05 AM > Drive E: - scan started (Nuevo vol ~2795 GB, NTFS HDD )...

=> The drive is clean.

1/31/2017 10:52:05 AM > Drive F: - scan started (Nuevo vol ~1765 GB, NTFS HDD )...

=> The drive is clean.

1/31/2017 10:52:05 AM > Drive G: - scan started (no label ~1863 GB, NTFS HDD )...

=> The drive is clean.

REDACTED

  • Guest
Windows? You have access with the Win explorer by opening the appropriate drive ...
I do not have access. Windows explorer tells me to format drive H to use it. I am using windows 7.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31078
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Try to repair the MBR.
On a command prompt > bootrec /fixmbr <driveletter>:

Offline dbrisendine

  • Malware Fighter
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1258
Can you post the details of the logged message about Avast removing the file?  This information may help in determining what exactly happened.
Win7 x32 Ult. SP1, Brain 2.0 / Win10 x64, Brain2.5
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

Offline Cluster-Lizard2014

  • Sr. Member
  • ****
  • Posts: 343
Try the external HDD on another PC if possible. If the same problem repeats then rule out any other hardware issues like the external enclosure or USB cable connection faults. Try another HDD in the same enclosure to be sure.   

Then I'd shut down the PC again and restart with the problem drive attached.

In Win7 go to: Control Panel > System and Security >  Administrative Tools > Computer Management > Storage > Disk Management(Local) and see what it reporting about the H:\ drive. If it is recognised there and shown as unformatted but 'healthy' then I'd follow Eddy's advice about repairing its MBR.

If that doesn't work and you still can't access any content without reporting the drive needs to be formatted then you need to be looking at the use of data recovery software.

Of course you must NOT reformat the HDD at any point or at least not until you've copied all the recoverable data from it.


REDACTED

  • Guest
Can you post the details of the logged message about Avast removing the file?  This information may help in determining what exactly happened.

Avast took the file autorun.inf from the external 2.5 drive when I pluged it in to the usb and put it in the "baul de virus". See the attached image.
The drive was working ok. Never had a problem. I was using it that day in other computer.

REDACTED

  • Guest
Re: Avast deleted autorun file from external drive, now drive is Inaccessible
« Reply #10 on: February 01, 2017, 08:21:14 PM »
Try the external HDD on another PC if possible. If the same problem repeats then rule out any other hardware issues like the external enclosure or USB cable connection faults. Try another HDD in the same enclosure to be sure.   

Then I'd shut down the PC again and restart with the problem drive attached.

In Win7 go to: Control Panel > System and Security >  Administrative Tools > Computer Management > Storage > Disk Management(Local) and see what it reporting about the H:\ drive. If it is recognised there and shown as unformatted but 'healthy' then I'd follow Eddy's advice about repairing its MBR.

If that doesn't work and you still can't access any content without reporting the drive needs to be formatted then you need to be looking at the use of data recovery software.

Of course you must NOT reformat the HDD at any point or at least not until you've copied all the recoverable data from it.

I tried the external HDD in other two PCs.  I restarted one pc with the drive attached. The same message all time... "Drive does not have format..do you want to format?"

I went to Disk management and the H drive is correct.

I have tried to do what Eddy told me about MBR on the command prompt but it replays "system cannot found the specified file". I found a "rebuild MBR" function on the minitool partition wizard software and use it, but nothing happened.


Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37597
  • Not a avast user
Re: Avast deleted autorun file from external drive, now drive is Inaccessible
« Reply #11 on: February 01, 2017, 08:36:11 PM »
cant see on the screenshot, but what malware name did avast give the detected file?


REDACTED

  • Guest
Re: Avast deleted autorun file from external drive, now drive is Inaccessible
« Reply #12 on: February 01, 2017, 09:24:44 PM »
Sorry, the virus name is INF:AutoRun-gen@bhv[Wrm].

REDACTED

  • Guest
Re: Avast deleted autorun file from external drive, now drive is Inaccessible
« Reply #13 on: February 02, 2017, 10:02:08 PM »
Try the external HDD on another PC if possible. If the same problem repeats then rule out any other hardware issues like the external enclosure or USB cable connection faults. Try another HDD in the same enclosure to be sure.   

Then I'd shut down the PC again and restart with the problem drive attached.

In Win7 go to: Control Panel > System and Security >  Administrative Tools > Computer Management > Storage > Disk Management(Local) and see what it reporting about the H:\ drive. If it is recognised there and shown as unformatted but 'healthy' then I'd follow Eddy's advice about repairing its MBR.

If that doesn't work and you still can't access any content without reporting the drive needs to be formatted then you need to be looking at the use of data recovery software.

Of course you must NOT reformat the HDD at any point or at least not until you've copied all the recoverable data from it.

I used the remo recover Software. It found almost all the files, but to recover them I have to pay 99 USD. Do you know any data recovery software as good as the remo software that can be used for free? ......I also used the recuva software but didn’t have good results.