The worm Win32/Bundpil.s, Win32/Bundpil.a or win32/ bundpil.xx or win32.agent bundpil was added by eset on January 10, 2013.
The indications that you are infected with this malicious worm is; when opening the flash drive, usb drive, external hard drive or any external storage device, you haven’t seen anything except the shortcut link file of the name of your external storage device.
Example, if you have a 4 Gb removable drive and you try open it, the drive letter of that certain drive would only show a shortcut link such as xxxx(4gb).lnk (where xxxx is the name of the removable device) and (4gb is the size of the flash drive) and all of your files suddenly disappear. Sometimes you see nothing even the shortcut link icon because it is deleted with your anti virus software.
Actually the files in the flash disk wasn’t really disappear or deleted. It’s just move to another folder, just click the shortcut link of the drive and you will be redirected to your files. But be aware clicking the shortcut is equivalent of clicking a virus.To fix the problem, update the anti-virus into it’s latest signature.
Then run a quick scan to your computer including the infected external storage device . After the worm Win32/Bundpil.s win32/bundpil.xx has been remove, follow the steps below to completely fix and restore your external drive way back before the problem occurs.
But Before you proceed make sure you have select and unhide the following:
- Select Show hidden files, folders, or drives
- Uncheck Hide extensions for known file types
- Unchecked Hide protected operating files (recommended)
All the selection is located in My Computer, Tools, Folder Options Menu.
Open the removable drive and delete the all files except the encircled one. |
Then open the disk like icon, that is the place where all your file move by Win 32 Bundpil.S Worm.
After opening it, select all the files inside, and cut and paste it outside that encircled disk icon.
Delete the disk icon to complete the recovery. Now remove your external drive and put it back again and check if the same problem occurs. If you see your files again, you did it right. You have successfully completed the instruction.
Note: the above procedure such as the disk like icon with no drive letter and the file autorun.inf and _Wq.init are hidden by default. Be sure to follow the above instructions.
[…] Related Topic: External Storge Device infected with Win32 bundpil worm […]
thanks for additional info Prince…
Fear not! your files are just hidden, most of the times you could easily unhide them through “tool>folder options>view>show hidden files and folders but there arecases wherein you still could not seeyour files.
Here is the step by step procedure to those files hidden by a virus.
1. Press Start and choose run.
2. On the dialog box type in cmd
3. On the Command Prompt type in the drive letter followed by a colon
4. type in “attrib *. -h -s /s /d“
5. if problem still persists try typingin “attrib -r -a -s -h *.*“
Always remember to place a hidden folder named “autorun.inf” on your usb stick, this usually helps prevent infection on whatever computer you insert your pendrive on (incase your drive gets contaminated)
Thanks
thanks to the comment guys 😀
uncheck the hide protected operating system files in folder options selection.
but be sure you have updated to latest virus definition and scan your computer for viruses. Some viruses don't allow you to show the hidden folders or files.
other options. try the procedure above to another computer ^_^
what will i do if no hidden files or folders were found?
Thank you so very much! Seems to be working!
Muy buen tip muchas gracias
After all, before you remove external drive and put it back again, format removable drive to complete the recovery.
This one comes out very handful… Great! Thanks!