LNK Jenxcus-D [Trj] Virus on USB-Stick

Viruses and worms
1

Hello,

Yesterday I copied some files from another PC onto my USB-stick. When I plugged in the USB in my PC, Avast immediately alerted me that ALL files on my USB-Drive are infected with the LNK Jenxcus-D Virus, and moved these Files into the Virus Chest. All Files and Folders seem to now have .lnk ending in the Virus Chest.

Is it possible to save/clean the Files from the Stick without losing them?

Any help would be appreciated!

** I am unsure which program logs i should upload to help diagnose/ fix the problem?

2
** I am unsure which program logs i should upload to help diagnose/ fix the problem?
all listed here, including SPECIFIC INFECTIONS LOGS >> https://forum.avast.com/index.php?topic=194892.0
3

Thanks for the replay, here are the Malwarbytes, FRST and MCshield logs

4

Your USB stick was infected with this
https://www.virustotal.com/gui/file/502cf74547e727416b051eef9d42d809c803ea1beffc13352514acbedb8ad794/detection

Yesterday I copied some files from [b]another PC[/b] onto my USB-stick.
This computer is infected

@Sass Drake will give instructions when he is online

5

oki doki, thank you

6

Another PC is infected but this PC is not according to logs.
Open USB disk in File Explorer, hold Shift button and right click on empty space. You will see option Open PowerShell windows here and click on it. (holding Shift is no longer required).
Type:

attrib -s -h *

and press Enter.

7

Ok, i just did this and the following files appeared on my usb stick:

autorun.inf.vir
bootmgr
bootmgr.efi
setup
systemstick.exe.vir

What are these files and can i delete them? The files that were on the usb stick but got infected, is there anyway to safely get them back?

8

Folders and files hidden by USB worm should be visible on USB disk after that command. Filenames you wrote belongs to Windows installation media and you can delete them if you wish. Also try this wo show hidden files and folders in File Explorer.

https://thegeekpage.com/how-to-view-hidden-system-files-in-windows-10/

9

Ok thank you!
Now i can see the files/folders that were on the stick, but they are now greyed out. Is it safe to open these files/folders? Or are they not infected with the virus?

10

It means they are hidden and you can open them.

Please repeat PowerShell instructions with this command:

attrib -s -h *.*
11

ok, i repeated the powershell and entered the code like you said, but didnt notice anything different. So i have opened these files and also copied them onto a hard drive, i assume they are safe now and no longer infected.

i should probably remove the “show hidden files” now that i do not need it anymore. Is there anything i have to do in the powershell command to return everything to normal?

and i assume i can use my usb as normal now, right?

12

Try this one in root of USB drive:

attrib -h -r -s *.*
13

still seeing no change… :o

14

I have no more ideas. :frowning:

15

all good, thank you very much for your help so far :smiley:

i have now been able to access the files that were on the stick, so that problem has been solved.
Is the usb stick now virus-free and usable again?? if it is, then the problems have been solved! :smiley:

16

Recomended that you keep MCShield program, evry time you plug in a USB storage device it will auto scan it and kill/remove any bug that try to jump from disk to computer

Also install it on the infected computer, you may advice owner of that computer to get it checked by @Sass Drake here