the files are still shortcuts even after the mcshield scans and it says the source of the files is “cmd (C:\Windows\system32)”