RadminerFlashRestorer Publisher's description
from Kaspersky Lab
The malware family Worm.Win32.Radminer infects removable media. It moves all the folders stored on the removable device to a hidden folder with a specific name, making it impossible to access them by standard means (Windows explorer, Far, Total Commander, etc.) after deleting infected files.
How to restore the access to folders:
Use the RadminerFlashRestorer utility.
Download the RadminerFlashRestorer.
Extract its content with an archiver, WinZip for example.
Once run, the utility would scan all the removable media for a folder generated by the malicious program and rename it into RESTORED_date_time.
Find and rename such a folder manually.
Open the terminal: Start > Run > type in cmd > press Enter.
Go to the root of the infected removable device file system by typing its name (E: for example) and pressing Enter.
Execute the following command: dir /x.
If this device contains a folder hidden by the given malicious program, you will see dots ( "..") instead of its name.
The column next to it will contain the short name by which the folder can be accessed (for example, E2E2~1).
Rename the folder by its short name using the following command: ren <short_folder_name> RESTORED.
System Requirements:No special requirements.
Program Release Status: New Release
Program Install Support: Install and Uninstall