It's a virus "autorun"



First check your computer for viruses. Under normal status report security, open the flash drive in total commander and find all directories without a name. Log in files stored in such directories, and change the attributes - remove all four jackdaws and click "OK". Make sure that hidden files on a flash drive is no more.

Next is to see what starts up each of the visible labels. They usually trigger the same file on the same drive. Check the properties of the shortcut. In the case of infection is detected dual launch — the first opens the directory and the second runs the virus program. In the "Object" you can see the path of the virus, usually this is something like "11dc09d81.exe" in the Recycle directory on this drive. Remove it together with the catalog.


Restore files



Remove any shortcuts to directories. Icons of directories is transparent — this means that the viral program loader marked these directories as system and hidden. To turn off these attributes, use their reset via command line.

Click "start" click "Run." Type CMD and press ENTER. In the command prompt window, type the commands: cd /d f:\ press ENTER, where f:\ is the designation of drive (pendrive); attrib-s-h /d /s press ENTER — this command removes the attributes, and directories are visible.

Alternatively, you can create a text file directly on the flash drive. Enter the file command attrib-s-h /d /s, rename the file with названием1.bat and run it. The command may take quite a long time depending on the number of files. You can then bring back the original look of the folders, that is, to hide system hidden files.

How to check whether the computer is a carrier of the virus?



If there is a suspicion that this computer virus spreads via USB drives, you can refer to the list of processes in task Manager. To do this, run the Manager and check the registry for the current process type name XSd8USB7858.

Keep in mind that this process is impossible to remove AviraAntivir, DrWeb CureIT, Kaspersky Removal Tool. That is, your task is to find the antivirus removal tool which can remove this source. It is driver-defined with the help of Autoruns.

For further protection from the virus you can create a directory with name Autorun.inf. The point of this is to create a file with a name that is already assigned to a directory is impossible.