The worm Win32/Bundpil.s, Win32/Bundpil.a or win32/ bundpil.xx or win32.agent bundpil was added by eset on January 10, 2013.
The indications that you are infected with this malicious worm is; when opening the flash drive, usb drive, external hard drive or any external storage device, you haven’t seen anything except the shortcut link file of the name of your external storage device.
Example, if you have a 4 Gb removable drive and you try open it, the drive letter of that certain drive would only show a shortcut link such as xxxx(4gb).lnk (where xxxx is the name of the removable device) and (4gb is the size of the flash drive) and all of your files suddenly disappear. Sometimes you see nothing even the shortcut link icon because it is deleted with your anti virus software.
Actually the files in the flash disk wasn’t really disappear or deleted. It’s just move to another folder, just click the shortcut link of the drive and you will be redirected to your files. But be aware clicking the shortcut is equivalent of clicking a virus.To fix the problem, update the anti-virus into it’s latest signature.
Then run a quick scan to your computer including the infected external storage device . After the worm Win32/Bundpil.s win32/bundpil.xx has been remove, follow the steps below to completely fix and restore your external drive way back before the problem occurs.
But Before you proceed make sure you have select and unhide the following:
- Select Show hidden files, folders, or drives
- Uncheck Hide extensions for known file types
- Unchecked Hide protected operating files (recommended)
All the selection is located in My Computer, Tools, Folder Options Menu.
|Open the removable drive and delete the all files except the encircled one.|
Then open the disk like icon, that is the place where all your file move by Win 32 Bundpil.S Worm.
After opening it, select all the files inside, and cut and paste it outside that encircled disk icon.
Delete the disk icon to complete the recovery. Now remove your external drive and put it back again and check if the same problem occurs. If you see your files again, you did it right. You have successfully completed the instruction.
Note: the above procedure such as the disk like icon with no drive letter and the file autorun.inf and _Wq.init are hidden by default. Be sure to follow the above instructions.