Shortcut virus - location: cmd (C:\Windows\System32)

Viruses and worms
1

can u help me please i followed these steps :slight_smile: :slight_smile: thank in advanceeeeee :wink: i will attach the logs

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Click on the Scan button.
After the scan has finished click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
Post logfile will also be saved in the C:\AdwCleaner folder.
Then…

Please download GMER, AntiRootkit tool from the link below and save it to your Desktop:

Gmer download link
Note: file will be random named

Double-clicking to run GMER.
Wait for initial scan to finish - if there is any query, click No;
Click Scan button and wait until the full scan is complete;
Click Save … - save the report to the Desktop (named Gmer );

Attach here Gmer logreports.

Then…

Please download Farbar Recovery Scan Tool by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Under Optional Scan ensure “List BCD” and “Driver MD5” are ticked.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

2

Hi there, I assume this was contracted through a USB drive

Download the attached Fixlist.txt to the same location as FRST
Run FRST and press Fix
On completion a log will be generated please post that

THEN

Download MCShield to your desktop and install
It will initially run a scan and show the result as a toaster by the system clock
Then in the control centre select scanner and tick unhide items on flash drives

https://dl.dropbox.com/u/73555776/mcshield%20unhide.JPG

Plug in the drive and McShield will start a scan

Then get the log which will be located under the logs tab on the main page

And post that

3

thank u very much for ur help :smiley: :slight_smile: :slight_smile: :smiley: the logs are attached

4

How is the computer behaving now ?

5

its betteeer thank uuuuuu very much :wink: :wink: :smiley: :smiley:

6

In that case methinks I will send you on your merry way :slight_smile:

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article and this article.
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG

Malwarebytes.

Update and run weekly to keep your system clean

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave:

7

thannnnnnnnnnnnk uuuuuuuuuuuuuuu thankkkk uuuuuuuu :wink: :wink: :smiley: :smiley: i have downloaded all of them

can i ask a favor i’m thinking to change my antivirus which is better avast pro antivirus or internet security ?

and what is this message c\user\hp\appdata\roaming\aiasfacoiaksf.vbs’. ?

8

Is that appearing when you start the computer ?

9

hey
i have the shortcut virus but have no idea how to remove it from both my notebook or usb. this is what it says in my start up tpizphdcoj…vbs can you please help

10

yes it appears when i start the computer

11

Puye,

go Here. Do as that says in that thread. Then I can get someone to help you

12

A Sarah… It appears that FRST did not report one of the launch points… Quick fix

Download OTL to your Desktop
Secondary link

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropboxusercontent.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[]Select LOP and Purity
[]Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%*.exe
CREATERESTOREPOINT

[*]Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

13

thannnnk u for helping me :slight_smile: :smiley:

14

Surprised that FRST did not show that one

Run this fix and reboot on completion. If the miscreant no longer appears then run OTL and press the cleanup button

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
O4 - Startup: C:\Users\hp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asodakaossd.lnk = C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation)

:Files
C:\$Recycle.bin\S-1-5-21-2866893448-3841764699-3020279588-1000\$R9EEE8T

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done

15

ur excellent eveything is going well now thaaaaaaaaaankkkk u thannnnnnnnk u very much :smiley: :slight_smile: :smiley:

16

Sorry about the little foopah :-[