Shortcut virus - location: cmd (C:\Windows\System32) ????

Viruses and worms
1

Hi, :slight_smile:
yesterday my USB drive picked up a virus from an Internet cafe and my brothers laptop was infected and now every time that I’ve inserted an USB in the laptop my files turned into shortcuts.
I right-clicked one of the shortcuts, and looked at where its target location is, and it’s somewhere in System32. When I open its target location, it takes me to System32, and the file in System32 that it highlights is cmd.exe

It’s something like this:
http://imageshack.us/a/img545/1559/7oey.png

how can I delete this virus? Thank you in advance

2

Hi,

From now on, do not use any USB on this computer, until I tell you so.

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

[*]Click on the Scan button.
[*]After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

[*]After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
[*]Post logfile will also be saved in the C:\AdwCleaner folder.

Then…

Please download GMER, AntiRootkit tool from the link below and save it to your Desktop:

Gmer download link
Note: file will be random named

Double-clicking to run GMER.

[*]Wait for initial scan to finish - if there is any query, click No;
[*]Click Scan button and wait until the full scan is complete;
[*]Click Save … - save the report to the Desktop (named Gmer );

Attach here Gmer logreports.

Then…

Please download Farbar Recovery Scan Tool by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Under Optional Scan ensure “List BCD” and “Driver MD5” are ticked.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

3

Twin, thank you for helping me again ;D :smiley: :slight_smile:

ok, I’ve attached the files

4

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Startup: C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.vbs ()
C:\Users\Max\AppData\Roaming\Microsoft.vbs
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs
HKCU\...\Run: [Microsoft] - C:\Users\Max\AppData\Roaming\Microsoft.vbs [32768 2013-06-08] ()
C:\Users\Max\AppData\Local\Temp
cmd: ipconfig /flushdns

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.

Then…

Re-run FRST and post me the fresh report.

5

ok :wink:

6

Hi,

System is now clean, let’s clean USB

Download MCShield from one of the following links:

MyCity - Official download link
Softpedija - Mirror download link

[*] Double click MCShield-Setup to install the application.
[*] Wait a few seconds to MCShield finish initial scan.
Recommendation to under General and Scanner tab you click on Defaults button to choose recommended options.
[*] Connect your USB storage devices to the computer one at a time. Scanning will be done automatically.

When all scanning is done, you need to attach a logreport that MCShield has created.

Start → All Programs → MCShield → Logs

Attach here → AllScans.txt

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.

7

my virus is completely gone!!!
thank you for all your help, thank you, thank you ;D :smiley: :slight_smile:
best regards

8

Did you followed my last post about MCShield? Please attach the report, so we can finish…

9

yes I did :wink:
haha I forgot attach the file I’m sorry

10

Ok, we’re done here :slight_smile:

You’re clean. Keep using MCShield, it will protect you in the future.

Please download DelFix by “Xplode” to your Desktop.

Run the tool and check the following boxes below;

[] Remove disinfection tools
[] Create registry backup
[*] Purge System Restore

Now click on “Run” button. Wait for the programme completes his work.
All the tools we used should be gone.
Tool will create and open an log report (DelFix.txt)
Note: The report will also be stored on C:\DelFix.txt

I don’t need DelFix log report.

11

oki :slight_smile:

Twin, thank you very much for taking your time to help me ;D

12
yesterday my USB drive picked up a virus from an Internet cafe [b]and my brothers laptop [/b] was infected and now every time that I've inserted an USB in the laptop [b]my files[/b] turned into shortcuts.
Your Brother may need a check also?...... or was this his computer
13
Your Brother may need a check also?...... or was this his computer

it’s my brothers laptop but I often use his computer, and the USB is mine :slight_smile:

and now it’s clean ;D

thank you

14

Hello Twin headed eagle !

I here face the same problem but I am attaching herewith the log created by gmer and Farbar addition.txt and FRST.txt . I am facing problem only with my PLAYSTATION PORTABLE FOLDERS and not in any other Pen drive or external hard drives. I need to copy a game folder to play it, but all folders are in shortcut having destination folder as cmd (C:\Windows\System32).

Please help me

Thanks in advance

15

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

HKCU\...\Run: [MICROS~1] - C:\Users\Balaji\AppData\Local\Temp\MICROS~1.VBS [152739 2013-09-26] () <===== ATTENTION
C:\Users\Balaji\AppData\Local\Temp\MICROS~1.VBS
Startup: C:\Users\Balaji\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MICROS~1.VBS ()
SearchScopes: HKCU - {A643866A-DEF7-471A-9D9B-6568AED1DC54} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253
BHO-x32: Browse2sauVe - {DAE24DC8-0763-9FBE-8520-236D139AECEE} - C:\ProgramData\Browse2sauVe\5145c9a53c1f3.dll No File
C:\ProgramData\Browse2sauVe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\Balaji\AppData\Local\Temp
cmd: ipconfig /flushdns
AlternateDataStreams: C:\ProgramData\Temp:862BDB1A
AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.

Check USB storage devices / removable drives

Download MCShield from one of the following links:

MyCity - Official download link
Softpedija - Mirror download link

[*] Double click MCShield-Setup to install the application.
[*] Wait a few seconds to MCShield finish initial scan.
Recommendation to under General and Scanner tab you click on Defaults button to choose recommended options.
[*] Connect your USB storage devices to the computer one at a time. Scanning will be done automatically.

When all scanning is done, you need to attach a logreport that MCShield has created.

Start → All Programs → MCShield → Logs

Attach here → AllScans.txt

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.

16

Hello TwinHeadedEagle !

Thanks for helping me out again ! :slight_smile:

Herewith I am attaching 3 text files :- i.) The initial scan of McShield ii.) The Log report and iii.) AllScans

I checked the USB drive, that is the PSP, but the folders remain in shortcut form.

Thanks once again and please reply as soon as possible .

17

Re-run FRST, press Scan and attach fresh report. How are the things now?

18

Hello Sir,

Thanks for your prompt reply.

Here are the fresh FRST and Addition report alongwith the latest McShield log report.
The situation seems similar : all shortcut folders , but now the files within them seem to be deleted as an error pops up telling it cannot find or locate them. but another page opens
with a blank older of the same name.

19

Hello Sir,

One more new development from my previous post.

I disconnected the USB and reconnected again. McShield held new reports and I am attaching it here.
It seems it found a virus again and terminated the files.

three folders were relieved from the shortcut state when I checked the PSP the moment after the scan by McShield and I was able to access them as well.
These were the ISO folder and a PSP folder with another Music folder.

But these transformed back to their shortcut state a few seconds after…

20

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

HKCU\...\Run: [MICROS~1] - C:\Users\Balaji\AppData\Local\Temp\MICROS~1.VBS [152739 2013-09-26] () <===== ATTENTION
C:\Users\Balaji\AppData\Local\Temp\MICROS~1.VBS
MountPoints2: {2d5c19f1-eb5e-11e2-b825-ca3b13010967} - D:\Setup.exe
MountPoints2: {c5107f09-22ee-11e3-a104-8c31140b1db2} - D:\Setup.exe
Startup: C:\Users\Balaji\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MICROS~1.VBS ()
SearchScopes: HKCU - {C54FC543-61A9-4E31-B1C5-943358AD8087} URL = http://www.mysearchresults.com/search?c=2402&t=15&q={searchTerms}
Task: {192A48BA-0F74-42C0-8CA9-84652981944B} - System32\Tasks\{D4E0CE48-2627-4E53-B140-47375ADE0D48} => C:\Users\Balaji\Desktop\SETUP.EXE
Task: {20C23D6B-58D6-40BB-87D2-9F43B2F6C4F1} - System32\Tasks\{4A5C158C-439D-4A32-81E6-C639168EA4A6} => C:\Users\Balaji\Desktop\SETUP.EXE
C:\Users\Balaji\Desktop\SETUP.EXE
Task: {33719C2E-7EC1-48DD-963F-98BA6E3A3CDD} - System32\Tasks\{ACA90015-7A06-470F-A178-871F39F6A368} => C:\Users\Balaji\Desktop\SETUP.EXE
Task: {53C8025D-E404-43A8-86B8-94853AC45624} - System32\Tasks\{28E90CCA-A548-4FB5-A8C5-A351ED861849} => C:\Users\Balaji\Desktop\SETUP.EXE
Task: {8D347378-4B88-413E-8CF7-C5CDA5943597} - System32\Tasks\{B4C3B763-1096-4647-B93F-CDF4C1927AB6} => C:\Users\Balaji\Desktop\SETUP.EXE
Task: {922B73FF-473A-4701-BB76-CCAB938E8156} - System32\Tasks\{1A2F2AE2-21A9-42C2-8E34-495E9238F6EA} => C:\Users\Balaji\Desktop\SETUP.EXE
Task: {9DE9AA96-F7B5-45E9-9E4C-E57508F15AD8} - System32\Tasks\{111A1073-1E12-44EA-A071-E7B455D2793C} => C:\Users\Balaji\Desktop\SETUP.EXE
Task: {B4172B90-4BED-4DCD-A705-C3F3F40E90A6} - System32\Tasks\{B316956C-AAEA-4487-87C7-0EF16F5B3BAE} => C:\Users\Balaji\Desktop\SETUP.EXE

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.