Avast deleted autorun file from external drive, now drive is Inaccessible

[REDACTED]

Hi. Today I connected my external wd 2.5 drive to the computer and avast send an alert message and erased the autorun.inf file from this drive. After this windows couldn’t access any more to the drive. I went to avast and try to restore the file but it doesn’t do it because there is no access to the drive, because I assume this file was deleted. Please, can someone tell me how to fix this, so to not lose my files? Thank you.

[Pondus]

Try this >  https://forum.avast.com/index.php?topic=194892.0

Scroll down to SPECIFIC INFECTIONS LOGS

Follow instructions for MCShield and copy paste the log here

[Eddy]

autorun.inf is not needed to access a drive (hd, dvd, cd, usb stick etc)
It is used to automatically run something on that drive.

I very much doubt that file was there legitimately.

[stibi]

Windows? You have access with the Win explorer by opening the appropriate drive ...

[REDACTED]

Try this >  https://forum.avast.com/index.php?topic=194892.0

Scroll down to SPECIFIC INFECTIONS LOGS

Follow instructions for MCShield and copy paste the log here

I downloaded MCShield and installed it. I followed the instructions and then plug in the drive, but the bellow log does not show a scan to this drive (H). I asume drive H cannot be access by MCShield.



>>> MCShield AllScans.txt <<<

-----------------------------
MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2016.2.21.1 / Windows 7 <<<

1/31/2017 10:52:05 AM > Drive C: - scan started (no label ~98 GB, NTFS HDD )...

=> The drive is clean.

1/31/2017 10:52:05 AM > Drive E: - scan started (Nuevo vol ~2795 GB, NTFS HDD )...

=> The drive is clean.

1/31/2017 10:52:05 AM > Drive F: - scan started (Nuevo vol ~1765 GB, NTFS HDD )...

=> The drive is clean.

1/31/2017 10:52:05 AM > Drive G: - scan started (no label ~1863 GB, NTFS HDD )...

=> The drive is clean.

[REDACTED]

Windows? You have access with the Win explorer by opening the appropriate drive ...

I do not have access. Windows explorer tells me to format drive H to use it. I am using windows 7.

[Eddy]

Try to repair the MBR.
On a command prompt > bootrec /fixmbr <driveletter>:

[dbrisendine]

Can you post the details of the logged message about Avast removing the file?  This information may help in determining what exactly happened.

[Cluster-Lizard2014]

Try the external HDD on another PC if possible. If the same problem repeats then rule out any other hardware issues like the external enclosure or USB cable connection faults. Try another HDD in the same enclosure to be sure.   

Then I'd shut down the PC again and restart with the problem drive attached.

In Win7 go to: Control Panel > System and Security >  Administrative Tools > Computer Management > Storage > Disk Management(Local) and see what it reporting about the H:\ drive. If it is recognised there and shown as unformatted but 'healthy' then I'd follow Eddy's advice about repairing its MBR.

If that doesn't work and you still can't access any content without reporting the drive needs to be formatted then you need to be looking at the use of data recovery software.

Of course you must NOT reformat the HDD at any point or at least not until you've copied all the recoverable data from it.

[REDACTED]

Can you post the details of the logged message about Avast removing the file?  This information may help in determining what exactly happened.

Avast took the file autorun.inf from the external 2.5 drive when I pluged it in to the usb and put it in the "baul de virus". See the attached image.
The drive was working ok. Never had a problem. I was using it that day in other computer.

[REDACTED]

Try the external HDD on another PC if possible. If the same problem repeats then rule out any other hardware issues like the external enclosure or USB cable connection faults. Try another HDD in the same enclosure to be sure.   

Then I'd shut down the PC again and restart with the problem drive attached.

In Win7 go to: Control Panel > System and Security >  Administrative Tools > Computer Management > Storage > Disk Management(Local) and see what it reporting about the H:\ drive. If it is recognised there and shown as unformatted but 'healthy' then I'd follow Eddy's advice about repairing its MBR.

If that doesn't work and you still can't access any content without reporting the drive needs to be formatted then you need to be looking at the use of data recovery software.

Of course you must NOT reformat the HDD at any point or at least not until you've copied all the recoverable data from it.

I tried the external HDD in other two PCs.  I restarted one pc with the drive attached. The same message all time... "Drive does not have format..do you want to format?"

I went to Disk management and the H drive is correct.

I have tried to do what Eddy told me about MBR on the command prompt but it replays "system cannot found the specified file". I found a "rebuild MBR" function on the minitool partition wizard software and use it, but nothing happened.

[Pondus]

cant see on the screenshot, but what malware name did avast give the detected file?

[REDACTED]

Sorry, the virus name is INF:AutoRun-gen@bhv[Wrm].

[REDACTED]

Try the external HDD on another PC if possible. If the same problem repeats then rule out any other hardware issues like the external enclosure or USB cable connection faults. Try another HDD in the same enclosure to be sure.   

Then I'd shut down the PC again and restart with the problem drive attached.

In Win7 go to: Control Panel > System and Security >  Administrative Tools > Computer Management > Storage > Disk Management(Local) and see what it reporting about the H:\ drive. If it is recognised there and shown as unformatted but 'healthy' then I'd follow Eddy's advice about repairing its MBR.

If that doesn't work and you still can't access any content without reporting the drive needs to be formatted then you need to be looking at the use of data recovery software.

Of course you must NOT reformat the HDD at any point or at least not until you've copied all the recoverable data from it.

I used the remo recover Software. It found almost all the files, but to recover them I have to pay 99 USD. Do you know any data recovery software as good as the remo software that can be used for free? ......I also used the recuva software but didn’t have good results.

[Eddy]

http://www.cgsecurity.org/wiki/TestDisk