Files on External/Flash Drive Changed to Shortcuts Virus

* If you did not format your flash drive, then check whether the files are not in hidden mode.
* Click on “Start” –>Run–>type cmd and click on OK.
* Check your external Drive letter in My Computer
* Here I assume your external drive as G:
* Enter this command.
* attrib -h -r -s /s /d g:*.*
* Delete the unnecessary shortcuts.

Note: Replace the letter g with your flash drive letter.

Still problem? Write down in comments section.

Usually this happens when your system is affected by TOEUW.EXE malware/virus

TOEUW.EXE is a malware which has the the following actions:

• Writes to another Process Virtual Memory (Process Hijacking)
• Executes a Process
• This process creates other processes in your system.
• Added as a Registry auto start to load Program on Boot up
• Created as a process in your system
• Executed as a Process

TOEUW.EXE has the following brother program file:

TOEUW.SCR

43553497.SCR

87263564.EXE

How to remove TOEUW.EXE – How to delete TOEUW.EXE

1. Kill the Toeuw.exe process on the Processes

2. Then download Combofix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

3. Create a folder in C: drive called ‘Combo’ and save the ComboFix.exe to that folder.

4. Close all other browser windows.

Important: Temporarily disable your anti-virus, real-time protection before performing a scan. They can interfere with combofix or remove some of its embedded files which may cause “unpredictable results”.

5. Go to start -> Run -> Type ‘cmd’(Without quotes) and click OK.

6. Type ‘cd\’ and Enter

7. Type ‘cd Combo’ and enter.

8. Type ‘ComboFix /snapshot’ then enter. It will run Combofix

Please note, that once you start combofix you should not click anywhere on the combofix window as it can cause the program to stall. In fact, when combofix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.

Don’t forget to restart the system once the process is completed.

When finished, it will produce a logfile located at C:\combofix.txt with the files removed.

GIVE COMMENTS....