Shortcut Virus

TwinHeadedEagle · 2015-07-10T18:13:21.000Z

Hello,

https://sites.google.com/site/cannedfixes/malwarebytes-anti-malware/51a46ae42d560-malwarebytes_anti_malware.png
Scan with Malwarebytes’ Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.

[*]Install the progam and select update.
[*]Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.
[*]Click the Scan tab, choose Threat Scan is checked and click Scan Now.
[*]If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
[*]Upon completion of the scan (or after the reboot), click the History tab.
[*]Click Application Logs and double-click the Scan Log.
[*]At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

Eddy · 2015-07-10T18:13:54.000Z

It is often transfered through a removable device.
Do you already have McShield installed ?
If not I suggest you do so and wait for further guidance from one of the malware removal experts.

system · 2015-07-10T18:59:52.000Z

Hey Twinheaded…

thanks for the quick reply… i’ve already attached the log after the scan…

@Eddy, yeah, got it from a usb but gonna follow twinheaded’s way of cleaning with mc…

system · 2015-07-10T19:00:59.000Z

forgot the attachment… haha…

TwinHeadedEagle · 2015-07-10T19:13:52.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Make sure that Addition option is checked.
[*]Press Scan button and wait.
[*]The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

system · 2015-07-10T19:21:25.000Z

here are the logs twinheaded…

TwinHeadedEagle · 2015-07-11T06:13:43.000Z

How is your PC behaving now?

system · 2015-07-11T17:54:13.000Z

it seems ok but i can’t clean my usb with the MCshield… i tried formatting the usb and also attached the log for you to check…

TwinHeadedEagle · 2015-07-11T18:14:16.000Z

Can you copy/paste MCShield report?

Pondus · 2015-07-11T18:24:46.000Z

Here Twin … used Android

MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

v 3.0.5.28 / DB: 2015.6.7.1 / Windows 7 <<<

7/12/2015 1:52:20 AM > Drive G: - scan started (LEXAR ~15263 MB, FAT32 flash drive )…

—> Executing generic S&D routine… Searching for files hidden by malware…

—> Items to process: 2

—> G:\Microsoft Excel.WsF.vir > unhidden.

—> G:\Microsoft Excel.WsF > unhidden.

G:\Microsoft Excel.lnk - Malware > Deleted. (15.07.12. 01.52 Microsoft Excel.lnk.661907; MD5: a97a2bbec83becb6b75fffdafaa00cb9)

=> Malicious files : 1/1 deleted.
=> Hidden files : 2/2 unhidden.

::::: Scan duration: 1sec ::::::::::::::::::
____________________________________________

TwinHeadedEagle · 2015-07-11T19:12:47.000Z

USB should be clean now.

system · 2015-07-13T15:27:07.000Z

hey twinheaded… how come everytime i scan my usb, i still get the same result with mcshield that it detected a malware and deleted it? then i refresh a few times and a shortcut then appears… i tried formatting my usb several times and still get the same result with mcshield…

TwinHeadedEagle · 2015-07-13T15:49:08.000Z

Did you plugin this USB into another PC?

system · 2015-07-13T15:51:13.000Z

nope… i didnt plug it into any other pc because i want to make sure it was clean first before i use it again. But i cant seem to clean it with the mcshield…

TwinHeadedEagle · 2015-07-13T15:51:53.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Make sure that Addition option is checked.
[*]Press Scan button and wait.
[*]The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

system · 2015-07-13T15:57:05.000Z

here it is twinheaded…

TwinHeadedEagle · 2015-07-13T17:29:31.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Press the Fix button just once and wait.
[*]If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
[*]When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

system · 2015-07-14T10:22:31.000Z

here is the fixlog twinheaded…

TwinHeadedEagle · 2015-07-14T20:17:53.000Z

How is the situation now?

system · 2015-07-16T14:08:39.000Z

i think it’s okay now since i’m not getting any of the virus that comes back even when i’m refreshing. thanks so much for the help.

Announcements