@a_sen, marek.lutz, shenoa86, nid_xperts:
Download Process Explorer from sysinternals.com (redirects to microsoft). Run and check for files that run with filenames similar to system files (eg. svchost.exe, regsvr.exe, winhelp.exe, chrome.exe). Check the icon of the file, if its icon is like that of a folder, then terminate it. Also check its path.
Download Autoruns from the same site and run it. Remove unwanted startup entries, make sure you don't remove any system processes.
Your folder, I guess, should still be hidden and not deleted. You can access the same by typing its full path in the address for of Explorer or just the folder name from its parent directory.
Open the drive that you have your folder in and search for all files with the extension .exe. Now sort it by file size. You can see many such files (with folder icons and .exe extension) all with the same size. More than one in case u are infected by more than one malware. You have no other option than to delete those exe files.
Those files are not your folders. Your folders are still in your disc but with a system file attribute. You can remove the attribute by following these steps:
1: Open cmd window (Start->Run->cmd)
2: Go to the drive where you have stored the folder
3: Type in the prompt:
attrib -s -h -r *.* /s /d. This removes system, hidden and read only attributes set to the files (all files and folders including subdirectories).
4: Now open windows explorer and
type the drive letter (eg d
in the address bar.
DO NOT double click on the drive yet.
5. You should see an autorun.inf file in the root. Open it with notepad and check the files that are mentioned in it (somefilename.exe or somefilename.cmd or somefilename.bat). These files run automatically when you double click on the drive. Take a note of those files.
6. Alt+Tab to windows explorer (d: or whatever) and delete those .exe/.cmd/.bat files. Also delete the autorun.inf file.
7. Don't do this to C:. You could end up deleting system files also.
8. Do the same to your other partitions except C: To delete it in c:
a) open cmd window
b) attrib -s -h -r autorun.inf (remove attributes to the autorun.inf)
c) attrib -s -h -r somefilename.exe (remove attributes to the malware mentioned in the autorun.inf)
d) do the same to all the files mentioned in autorun.inf
e) start C: (open C: in windows explorer from the command window)
f) delete the autorun.inf and other noted malwares
9. Close all open windows and restart XP.
10. After restarting open MyComputer and right click on a drive. You should see Open as the default option (in bold).
P.S: If you see Autoplay as the default option, you are still infected.
We will of course take some time to find and read your thread