Avast WEBforum

Other => General Topics => Topic started by: REDACTED on September 05, 2014, 06:16:56 AM

Title: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 05, 2014, 06:16:56 AM
These files was turned into shortcuts and its location is on windows/system32 cmd

Need help guys thank you   ;D
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: Asyn on September 05, 2014, 06:30:03 AM
Attach your basic logs. (MBAM, FRST and aswMBR..!!)
Instructions: https://forum.avast.com/index.php?topic=53253.0

Note: Unplug your USB first..!!
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 05, 2014, 07:31:09 AM
HERE ARE THE LOGS
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: Asyn on September 05, 2014, 07:37:24 AM
Good job, now you've to wait a bit...
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 05, 2014, 09:57:14 AM
Re-run FRST.exe as you did before ...

> Attach here fixlog.txt logreport.



Edit:

You have two antivirus Avira and MSE. Remove one.
Remove USBGuard.exe.
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 06, 2014, 02:41:43 AM
Will I uninstall it or just turn it off ?
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 06, 2014, 02:51:19 AM
@ARGUs i turned off my avira and uninstall my usbguard.

here are the log  :D
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: Pondus on September 06, 2014, 03:36:23 AM
You can only have 1 antivirus installed
http://blog.kaspersky.com/multiple-antivirus-programs-bad-idea/

Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 06, 2014, 07:20:17 AM
It is ok for having MICROSOFT SECURITY ESSENTIALS, MALWAREBYTES-ANTIMALWARE and MCShield to protect my computer or it is bad ?  ::)
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 06, 2014, 09:34:58 AM
MCShield log.

Under Logs tab (in Control Center) for AllScans.txt log section click on Save button. AllScanst.txt report shall be located on your Desktop.

=> Post here AllScanst.txt
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 06, 2014, 03:10:21 PM
Here .
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: bob3160 on September 06, 2014, 03:39:08 PM
It is ok for having MICROSOFT SECURITY ESSENTIALS, MALWAREBYTES-ANTIMALWARE and MCShield to protect my computer or it is bad ?
If you're using avast!, then you need to take Security Essentials out of that mix. The others are fine.
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 06, 2014, 03:40:32 PM
If I'm not using avast. It is fine right ?
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: bob3160 on September 06, 2014, 03:44:17 PM
If I'm not using avast. It is fine right ?
If you're not using avast!, why are you here asking for help cleaning up a corruption ???
Why not ask Microsoft since they're the ones who let you get infected in the first place.  ???
I'm not trying to be rude but I don't understand your logic and I'm sure argus will still continue to help you.
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 06, 2014, 03:49:57 PM
Its only a "if" sorry  ;D
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 06, 2014, 11:26:41 PM
How is the situation now?
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 07, 2014, 09:52:32 AM
It is okay if the cmd.exe is still there ?  :-\ or its not corrupted anymore ? I got 3 laptops that is corrupted by this malware/virus or whatever it is  :(
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 07, 2014, 11:20:44 AM
http://www.speedyshare.com/9Uj5f/Video-2014-09-07-111519.wmv

MCShield log - video
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 07, 2014, 11:28:03 AM


Scan with Combofix:
.



Then connect a pendrive and attach here the log.
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 07, 2014, 11:57:08 AM
Here are the log for the combo fix but i can't understand what are you saying about the "pendrive and the logs"

Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 07, 2014, 01:28:21 PM
Attach here All scans log (MCShield)



But here I do not see anything
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: Pondus on September 07, 2014, 01:38:02 PM
Quote
  but i can't understand what are you saying about the "pendrive and the logs"   
When you connect your pendrive, MCShield will scan it ....... when done, copy and paste the allscan.txt log here

There are some issues with some logs here in the forum, they are displayed as unicode when attached (looks like chinese so not readable. See pic in argus post) since this is a short log, you can copy and paste it

Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 07, 2014, 01:45:22 PM
Is it this ?

>>> MCShield AllScans.txt <<<

-----------------------------




MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/5/2014 12:04:02 PM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/5/2014 12:04:02 PM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.


9/5/2014 12:04:02 PM > Drive H: - scan started (no label ~120 MB, FAT flash drive )...


>>> H:\sipkrzpmyl..vbs - Suspicious > Renamed. (MD5: unknown)

>>> H:\AdwCleaner.exe - Suspicious > Renamed. (MD5: 9ded4724d695cfb01960426da011abae)

>>> H:\FRST.exe - Suspicious > Renamed. (MD5: 77ce274a97ed45aa2f582245f2895051)

>>> H:\shck0ju3.exe - Suspicious > Renamed. (MD5: 60bf4ae8cc40b0e3e28613657ed2eed8)


=> Suspicious files  : 4/4 renamed.

____________________________________________

::::: Scan duration: 6sec ::::::::::::::::::
____________________________________________




MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/5/2014 12:07:14 PM > Drive H: - scan started (no label ~120 MB, FAT flash drive )...


>>> H:\AdwCleaner.lnk.vir - Malware > Deleted. (; MD5: unknown)

>>> H:\MCShield-Setup.lnk.vir - Malware > Deleted. (; MD5: unknown)

>>> H:\FRST.lnk.vir - Malware > Deleted. (; MD5: unknown)

>>> H:\shck0ju3.lnk.vir - Malware > Deleted. (; MD5: unknown)

>>> H:\fixlist.lnk.vir - Malware > Deleted. (; MD5: unknown)

>>> H:\AdwCleaner.exe - Suspicious > Renamed. (MD5: 9ded4724d695cfb01960426da011abae)

>>> H:\FRST.exe - Suspicious > Renamed. (MD5: 77ce274a97ed45aa2f582245f2895051)

>>> H:\shck0ju3.exe - Suspicious > Renamed. (MD5: 60bf4ae8cc40b0e3e28613657ed2eed8)

>>> H:\sipkrzpmyl..vbs - Suspicious > Renamed. (MD5: unknown)


=> Malicious files   : 5/5 deleted.
=> Suspicious files  : 4/4 renamed.

____________________________________________

::::: Scan duration: 6sec ::::::::::::::::::
____________________________________________




MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/5/2014 12:22:53 PM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/5/2014 12:22:54 PM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/5/2014 12:54:28 PM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/5/2014 12:54:29 PM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/5/2014 1:20:07 PM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/5/2014 1:20:08 PM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/5/2014 8:23:23 PM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/5/2014 8:23:24 PM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/5/2014 11:14:09 PM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/5/2014 11:14:09 PM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/6/2014 8:36:16 AM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/6/2014 8:36:16 AM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/6/2014 3:42:24 PM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/6/2014 3:42:26 PM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/6/2014 4:11:32 PM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/6/2014 4:11:34 PM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/6/2014 6:13:42 PM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/6/2014 6:13:44 PM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/7/2014 9:34:29 AM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/7/2014 9:34:31 AM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/7/2014 10:04:27 AM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/7/2014 10:04:29 AM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.8.26.1 / Windows 7 <<<


9/7/2014 10:28:06 AM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/7/2014 10:28:06 AM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.9.6.1 / Windows 7 <<<


9/7/2014 2:57:52 PM > Drive G: - scan started (no label ~3893 MB, FAT32 flash drive )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.9.6.1 / Windows 7 <<<


9/7/2014 3:45:02 PM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/7/2014 3:45:04 PM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.9.6.1 / Windows 7 <<<


9/7/2014 4:04:59 PM > Drive H: - scan started (no label ~120 MB, FAT flash drive )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.9.6.1 / Windows 7 <<<


9/7/2014 5:47:01 PM > Drive C: - scan started (no label ~155 GB, NTFS HDD )...



=> The drive is clean.


9/7/2014 5:47:04 PM > Drive D: - scan started (no label ~311 GB, NTFS HDD )...



=> The drive is clean.



Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 07, 2014, 01:50:58 PM
This laptop is clean.
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 07, 2014, 01:53:52 PM
Do you have another laptop?
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 07, 2014, 01:56:22 PM
Thank you argus, pondus and the other generous guys  8)! I appreciated your help. Can you help me for the next 3 other laptops ? or I will just do what i've done in the first place ? If its ok? Then I think I can do it.  ;D
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: Pondus on September 07, 2014, 02:21:10 PM
Quote
    Can you help me for the next 3 other laptops   
Start with attaching logs for next computer ......
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 08, 2014, 03:07:17 AM
It is ok that I will not attach the log for MBAM cause the screen is too small so I can't click the export/save log. But it says no malware detected.


Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 08, 2014, 03:32:44 AM
For the fixlog.

and MCshield log

>>> MCShield AllScans.txt <<<

-----------------------------




MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.9.6.1 / Windows 7 <<<


09/08/2014 9:34:17 AM > Drive C: - scan started (no label ~127 GB, NTFS HDD )...



=> The drive is clean.


09/08/2014 9:34:18 AM > Drive D: - scan started (no label ~171 GB, NTFS HDD )...



=> The drive is clean.



Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: TrueIndian on September 08, 2014, 05:41:48 AM
If I'm not using avast. It is fine right ?
If you're not using avast!, why are you here asking for help cleaning up a corruption ???
Why not ask Microsoft since they're the ones who let you get infected in the first place.  ???
I'm not trying to be rude but I don't understand your logic and I'm sure argus will still continue to help you.

There is a point in bob's post.But i think we should work together to defeat malware and not watch who is using what and then help them.
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 08, 2014, 08:47:57 AM
Step1



Please download Anti-VBSVBEx86.exe (http://www.mcshield.net/download/tools/Anti-VBSVBE/Anti-VBSVBEx64.exe) on your Desktop
.






Step2






Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

.







Step3







1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Code: [Select]

Start
Task: {D80A6CFD-33D8-41C1-8154-74647AFF21B0} - \EPUpdater No Task File <==== ATTENTION
HKU\S-1-5-21-243076342-1454535561-2724800007-1000\...\MountPoints2: {15c632a0-d7b2-11dd-96b1-8c89a50159ac} - E:\AutoRun.exe
HKU\S-1-5-21-243076342-1454535561-2724800007-1000\...\MountPoints2: {6297d694-90f7-11e2-b4d3-8c89a50159ac} - E:\AutoRun.exe
HKU\S-1-5-21-243076342-1454535561-2724800007-1000\...\MountPoints2: {cbe44750-ea1b-11e2-83c5-b803059b2836} - E:\autorun.exe
HKU\S-1-5-21-243076342-1454535561-2724800007-1000\...\MountPoints2: {f2656dca-8d14-11e2-9086-806e6f6e6963} - E:\AutoRun.exe
HKU\S-1-5-21-243076342-1454535561-2724800007-1000\...\MountPoints2: {f2656e0b-8d14-11e2-9086-8c89a50159ac} - E:\AutoRun.exe
Ask Toolbar (HKLM\...\Ask Toolbar_is1) (Version: 4.1.0.5 - Ask.com) <==== ATTENTION
Torch (HKCU\...\Torch) (Version: 25.0.0.3359 - Torch Media Inc.) <==== ATTENTION
Reboot:
End

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.


3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 09, 2014, 03:26:17 AM
Here are the logs:

Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 09, 2014, 07:38:56 AM


Please download MCShield from one of the following links:

MCShield -Official download link (http://www.mcshield.net/download.html)
Under Logs tab (in Control Center (http://www.mcshield.net/personal/magna86/Images/MCShield%27s%20Control%20Center.jpg)) for AllScans.txt log section click on Save button. AllScanst.txt report shall be located on your Desktop.

=> Post here AllScanst.txt


Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.

.



Re-run FRST and click scan. Attach here report.
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 09, 2014, 04:51:20 PM
Hey guys, can we postpone in fixing the second laptop and turn into the 3rd laptop ?  Because some important matters came up. If its okay to you guys ? But we can continue the second laptop tomorrow or the next other days ?
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 09, 2014, 05:40:38 PM
I will attach the logs MBAM, Adwcleaner, MCShield, Aswmbr, FRST and Combofix
tomorrow okay ?  ;D  ;D  ;D but please tell me what is not necessary.
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 09, 2014, 06:20:51 PM
Second laptop is clean.


Combofix  is needless
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 09, 2014, 06:25:12 PM
For the 3rd one ^_^
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 09, 2014, 06:26:25 PM
For MCShield->

>>> MCShield AllScans.txt <<<

-----------------------------




MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.9.6.1 / Windows 8 <<<


9/9/2014 11:15:05 PM > Drive C: - scan started (no label ~231 GB, NTFS HDD )...



=> The drive is clean.


9/9/2014 11:15:10 PM > Drive D: - scan started (no label ~234 GB, NTFS HDD )...



=> The drive is clean.


9/9/2014 11:15:11 PM > Drive H: - scan started (no label ~120 MB, FAT flash drive )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.9.6.1 / Windows 8 <<<


9/10/2014 12:17:20 AM > Drive C: - scan started (no label ~231 GB, NTFS HDD )...



=> The drive is clean.


9/10/2014 12:17:22 AM > Drive D: - scan started (no label ~234 GB, NTFS HDD )...



=> The drive is clean.



Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 09, 2014, 06:27:23 PM
For the 2nd laptop. Thankyou bro.
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 09, 2014, 07:18:54 PM
Uninstall USB Security.




1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Code: [Select]
Start
BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} -  No File
C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} -  No File
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} -  No File
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} -  No File
Filter: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} -  No File
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} -  No File
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} -  No File
Filter-x32: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} -  No File
CHR StartupUrls: Default -> "hxxp://www.sweet-page.com/?type=hp&ts=1409102478&from=cor&uid=ST9500325AS_S2WFRLH3XXXXS2WFRLH3", "", "hxxp://start.pcfaster.com?_bid=fc227c5c700bbd6e3260db1f7c1ef5e0&_t=hpsf", "about:blank"
C:\ProgramData\FileSplitUpLoad.dll
HKU\S-1-5-21-2700310972-707006990-2831406632-1001\...\MountPoints2: {27465cfd-3693-11e4-bedc-685d43c01335} - "E:\AutoRun.exe"
EmptyTemp:
End
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.


3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version..






****************************






Please download Malwarebytes Anti-Malware (http://downloads.malwarebytes.org/file/mbam) ver. 2.0 and install the application.

Double-click on mbam-setup.exe and follow the prompts to install the program. Upon installation, click Finish
Note: A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish..
On the first launch, you'll get an "Update" notification. Click the 'Update Now >>' link or button to complete update.

• Configure the scanner. On the Settings tab, Detection and Protection adjust the following options:
- subtab Detection Options, tick the box 'Scan for rootkits'.
- subtab Non-Malware Protection, for PUP detections, from 'Warn user abaut detecion' select 'Threat detections as malware'.


• Preform the Scan. Click on the Scan tab, then click on Scan Now >> for Threat Scan.
If an update is available, click the 'Update Now' button, then continue to Scan.
Note: only with some infections, you may see this message box 'Could not load DDA driver'
In this case, click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.


When the scan is complete, click Apply Actions. Wait for the prompt to restart the computer to appear, then click on Yes.

• Post the logs. Click on the History tab > Application Logs. Double click on the Scan Log which shows the date and time of just performed scan.
- Click Export button at the bottom, and then select the 'Text file (*.txt)'
- In the Save File dialog box which appears, click on Desktop.
- In the File name: box type "mbam" (without quotes) for your scan log name and click Save.
- A message box "Your file has been successfully exported" should appear, click Ok and close the windows.



Please attach the exported/saved log named as mbam.txt to your next reply.
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 10, 2014, 04:29:11 AM
Here.

Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 10, 2014, 09:12:48 AM
How is the situation now?
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 11, 2014, 08:00:30 AM
It seems okay now.  ;D Thank you for the help . For the last laptop i will attach the logs tomorrow :)
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 12, 2014, 07:25:29 AM
Hey guys. I think the 3rd laptop has a problem. Because i transfer adwcleaner, frst, combofix, mcshield, awbr in a memory card and i put it on to the 4th laptop the files was turned into shortcuts.  :-\
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 13, 2014, 08:46:24 PM
@RichardGonzaga

Downloaded directly from the internet programs. You have 4 laptpop?

Do not use pendrive until I say
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 13, 2014, 11:03:05 PM
Not exactly. Its 4 laptop but only 2 is mine and the other 2 is the laptop of my dad.

But the 3rd laptop has no problems ?
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 16, 2014, 07:14:56 AM
For the last laptop  ;D

>>> MCShield AllScans.txt <<<

-----------------------------




MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 7 <<<


9/12/2014 11:40:49 AM > Drive C: - scan started (OS_Install ~174 GB, NTFS HDD )...



=> The drive is clean.


9/12/2014 11:40:49 AM > Drive D: - scan started (Data ~116 GB, NTFS HDD )...



=> The drive is clean.


9/12/2014 11:40:50 AM > Drive E: - scan started (no label ~120 MB, FAT flash drive )...



---> Executing generic S&D routine... Searching for files hidden by malware...


---> Items to process: 4

---> E:\MCShield-Setup.exe > unhidden.

---> E:\AdwCleaner.exe > unhidden.

---> E:\aswmbr.exe > unhidden.

---> E:\ComboFix.exe > unhidden.



>>> E:\MCShield-Setup.lnk - Malware > Deleted. (14.09.12. 11.41 MCShield-Setup.lnk.786236; MD5: eadaa9599a0779ee6e36d641542d665b)

>>> E:\AdwCleaner.lnk - Malware > Deleted. (14.09.12. 11.41 AdwCleaner.lnk.953361; MD5: b77c0f2285e996c1c9cb6dd2020e0fd4)

>>> E:\aswmbr.lnk - Malware > Deleted. (14.09.12. 11.41 aswmbr.lnk.917119; MD5: 22eea9062ecc9ad11b68f2711a2fb481)

>>> E:\ComboFix.lnk - Malware > Deleted. (14.09.12. 11.41 ComboFix.lnk.184765; MD5: c1a243155f3e332307d0f6d22d070ff7)

>>> E:\sipkrzpmyl..vbs - Malware > Deleted. (14.09.12. 11.41 sipkrzpmyl..vbs.19645; MD5: c9c4d00a62ff4fc4597b74f4bdd41cf9)

>>> E:\AdwCleaner.exe - Suspicious > Renamed. (MD5: 13ec9896cb74b8bd8f6c92135dfacd20)

>>> E:\aswmbr.exe - Suspicious > Renamed. (MD5: 9302d77a9f6683672a4f231da2b86059)


=> Malicious files   : 5/5 deleted.
=> Suspicious files  : 2/2 renamed.
=> Hidden files      : 4/4 unhidden.

____________________________________________

::::: Scan duration: 18sec :::::::::::::::::
____________________________________________

9/12/2014 11:41:06 AM > Drive W: - scan started (BIOS_RVY ~8 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 7 <<<


9/12/2014 11:42:01 AM > Drive E: - scan started (no label ~120 MB, FAT flash drive )...



---> Executing generic S&D routine... Searching for files hidden by malware...


---> Items to process: 2

---> E:\MCShield-Setup.exe > unhidden.

---> E:\ComboFix.exe > unhidden.



>>> E:\MCShield-Setup.lnk - Malware > Deleted. (14.09.12. 11.42 MCShield-Setup.lnk.506863; MD5: eadaa9599a0779ee6e36d641542d665b)

>>> E:\ComboFix.lnk - Malware > Deleted. (14.09.12. 11.42 ComboFix.lnk.566215; MD5: c1a243155f3e332307d0f6d22d070ff7)

>>> E:\sipkrzpmyl..vbs - Malware > Deleted. (14.09.12. 11.42 sipkrzpmyl..vbs.264394; MD5: c9c4d00a62ff4fc4597b74f4bdd41cf9)


=> Malicious files   : 3/3 deleted.
=> Hidden files      : 2/2 unhidden.

____________________________________________

::::: Scan duration: 12sec :::::::::::::::::
____________________________________________




MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 7 <<<


9/12/2014 11:42:45 AM > Drive E: - scan started (no label ~120 MB, FAT flash drive )...



---> Executing generic S&D routine... Searching for files hidden by malware...


---> Items to process: 2

---> E:\MCShield-Setup.exe > unhidden.

---> E:\ComboFix.exe > unhidden.



>>> E:\MCShield-Setup.lnk - Malware > Deleted. (14.09.12. 11.42 MCShield-Setup.lnk.476864; MD5: eadaa9599a0779ee6e36d641542d665b)

>>> E:\ComboFix.lnk - Malware > Deleted. (14.09.12. 11.42 ComboFix.lnk.476829; MD5: c1a243155f3e332307d0f6d22d070ff7)

>>> E:\sipkrzpmyl..vbs - Malware > Deleted. (14.09.12. 11.42 sipkrzpmyl..vbs.565221; MD5: c9c4d00a62ff4fc4597b74f4bdd41cf9)


=> Malicious files   : 3/3 deleted.
=> Hidden files      : 2/2 unhidden.

____________________________________________

::::: Scan duration: 11sec :::::::::::::::::
____________________________________________




MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 7 <<<


9/12/2014 11:45:32 AM > Drive E: - scan started (no label ~120 MB, FAT flash drive )...


>>> E:\sipkrzpmyl..vbs - Malware > Deleted. (14.09.12. 11.45 sipkrzpmyl..vbs.612042; MD5: c9c4d00a62ff4fc4597b74f4bdd41cf9)

>>> E:\AdwCleaner.exe - Suspicious > Renamed. (MD5: 13ec9896cb74b8bd8f6c92135dfacd20)

>>> E:\aswmbr.exe - Suspicious > Renamed. (MD5: 9302d77a9f6683672a4f231da2b86059)


=> Malicious files   : 1/1 deleted.
=> Suspicious files  : 2/2 renamed.

____________________________________________

::::: Scan duration: 11sec :::::::::::::::::
____________________________________________




MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 7 <<<


9/13/2014 7:46:53 AM > Drive C: - scan started (OS_Install ~174 GB, NTFS HDD )...



=> The drive is clean.


9/13/2014 7:46:55 AM > Drive D: - scan started (Data ~116 GB, NTFS HDD )...



=> The drive is clean.


9/13/2014 7:46:56 AM > Drive W: - scan started (BIOS_RVY ~8 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 7 <<<


9/13/2014 7:47:07 AM > Drive E: - scan started (JHAY27ANNE ~970 MB, FAT flash drive )...



---> Executing generic S&D routine... Searching for files hidden by malware...


---> Items to process: 37

---> E:\Freestyle - Half Crazy.mp3 > unhidden.

---> E:\Guy Sebastian - Angels Brought Me Here.mp3 > unhidden.

---> E:\Hoku - You First Believed.mp3 > unhidden.

---> E:\Toni Gonzaga - Catch Me Im Falling.mp3 > unhidden.

---> E:\Way Back Into Love - Hugh Grant & Haley Bennett - Music and Lyrics Soundtrack.mp3 > unhidden.

---> E:\Toni Gonzaga - You Are The One.mp3 > unhidden.

---> E:\MYMP-Only reminds me of you.mp3 > unhidden.

---> E:\Side A Band - So Many Questions.mp3 > unhidden.

---> E:\Yeng Constantino Ft. Rj Jimenez - If We Fall In Love.mp3 > unhidden.

---> E:\Toni Gonzaga feat. Utada Hikaru - First Belong.mp3 > unhidden.

---> E:\Boys 2 Men - Im down on bended knees.mp3 > unhidden.

---> E:\Freestyle - Till I Found You.mp3 > unhidden.

---> E:\Six Part Invention- All This Time.mp3 > unhidden.

---> E:\Your Love- Alamid.mp3 > unhidden.

---> E:\Lighthouse Family - Lost In Space.mp3 > unhidden.

---> E:\Yeng Constantino - Salamat .mp3 > unhidden.

---> E:\Yeng Constantino - Hawak Kamay.mp3 > unhidden.

---> E:\Dsound - Tatooed On My Mind.mp3 > unhidden.

---> E:\Beyonce - 09 - Irreplaceable.mp3 > unhidden.

---> E:\Music.m3u > unhidden.

---> E:\Natalie- Love You So.mp3 > unhidden.

---> E:\Sonata_Des_Cuilleres_DZed.sis > unhidden.

---> E:\AllMyLoveKata.sis > unhidden.

---> E:\GlassFlowersKata.sis > unhidden.

---> E:\RoseAndButterfly.sis > unhidden.

---> E:\Innocent.sis > unhidden.

---> E:\GreenKata.sis > unhidden.

---> E:\ButterflyKata.sis > unhidden.

---> E:\spiral.sis > unhidden.

---> E:\LoveKey.sis > unhidden.

---> E:\GreenFairy.sis > unhidden.

---> E:\Swirls.sis > unhidden.

---> E:\The_Fray_-_over_my_head.mp3 > unhidden.

---> E:\Desktop.ini > unhidden.

---> E:\Folder.htt > unhidden.

---> E:\Beauty and madness -  MYMP.mp3 > unhidden.

---> E:\FACEDAT.BIN > unhidden.



>>> E:\Freestyle - Half Crazy.lnk - Malware > Deleted. (14.09.13. 07.52 Freestyle - Half Crazy.lnk.105877; MD5: 707926adf84e563205daf1260a5df938)

>>> E:\Guy Sebastian - Angels Brought Me Here.lnk - Malware > Deleted. (14.09.13. 07.52 Guy Sebastian - Angels Brought Me Here.lnk.382270; MD5: 95dedf353d9ff9613c11ffbe6582bcce)

>>> E:\Hoku - You First Believed.lnk - Malware > Deleted. (14.09.13. 07.52 Hoku - You First Believed.lnk.541768; MD5: d25c094e24d4bf86678d5b9780c1933f)

>>> E:\Toni Gonzaga - Catch Me Im Falling.lnk - Malware > Deleted. (14.09.13. 07.52 Toni Gonzaga - Catch Me Im Falling.lnk.290692; MD5: 4910ba349f92ece0dd5b0ae8a2c3cbe8)

>>> E:\Way Back Into Love - Hugh Grant & Haley Bennett - Music and Lyrics Soundtrack.lnk - Malware > Deleted. (14.09.13. 07.52 Way Back Into Love - Hugh Grant & Haley Bennett - Music and Lyrics Soundtrack.lnk.487754; MD5: 75ca596568d44c86f0fa9b693c59fc74)

>>> E:\Toni Gonzaga - You Are The One.lnk - Malware > Deleted. (14.09.13. 07.52 Toni Gonzaga - You Are The One.lnk.811682; MD5: a31bf3d5211a638d9c92e288832dacc4)

>>> E:\MYMP-Only reminds me of you.lnk - Malware > Deleted. (14.09.13. 07.52 MYMP-Only reminds me of you.lnk.61137; MD5: ef8753ef83918e577c1bd471a33d4114)

>>> E:\Side A Band - So Many Questions.lnk - Malware > Deleted. (14.09.13. 07.52 Side A Band - So Many Questions.lnk.373822; MD5: 749dea7f97748401eb780902d6fa4a1b)

>>> E:\Yeng Constantino Ft.lnk - Malware > Deleted. (14.09.13. 07.52 Yeng Constantino Ft.lnk.170264; MD5: edc5f1da296b6a2ec7acfe7ae287e430)

>>> E:\Toni Gonzaga feat.lnk - Malware > Deleted. (14.09.13. 07.52 Toni Gonzaga feat.lnk.146050; MD5: 3d14d561650ff71f9e5847a9ef8f38d2)

>>> E:\Boys 2 Men - Im down on bended knees.lnk - Malware > Deleted. (14.09.13. 07.52 Boys 2 Men - Im down on bended knees.lnk.535267; MD5: fd864af49107bcad52660bb5995d7e4e)

>>> E:\Freestyle - Till I Found You.lnk - Malware > Deleted. (14.09.13. 07.52 Freestyle - Till I Found You.lnk.314957; MD5: 96a145b6b7216513c3114e2fa3796670)

>>> E:\Six Part Invention- All This Time.lnk - Malware > Deleted. (14.09.13. 07.52 Six Part Invention- All This Time.lnk.719568; MD5: f26eb0a1a866ec5479b88ce3b6821a5f)

>>> E:\Your Love- Alamid.lnk - Malware > Deleted. (14.09.13. 07.52 Your Love- Alamid.lnk.760863; MD5: 926b5b89d549d9bf803e90b622095c8b)

>>> E:\Lighthouse Family - Lost In Space.lnk - Malware > Deleted. (14.09.13. 07.52 Lighthouse Family - Lost In Space.lnk.530320; MD5: ed9c485c333a0a8a41a2f871eae87753)

>>> E:\Yeng Constantino - Salamat .lnk - Malware > Deleted. (14.09.13. 07.52 Yeng Constantino - Salamat .lnk.765298; MD5: 444247167c3305245834a8d38e565f82)

>>> E:\Yeng Constantino - Hawak Kamay.lnk - Malware > Deleted. (14.09.13. 07.52 Yeng Constantino - Hawak Kamay.lnk.391191; MD5: f1a8ff9d61b1a8e99c8f857c28b05223)

>>> E:\Dsound - Tatooed On My Mind.lnk - Malware > Deleted. (14.09.13. 07.52 Dsound - Tatooed On My Mind.lnk.981484; MD5: ce68c5b21ecfbb3d224cb9e18bfdeb0c)

>>> E:\Beyonce - 09 - Irreplaceable.lnk - Malware > Deleted. (14.09.13. 07.52 Beyonce - 09 - Irreplaceable.lnk.804400; MD5: 623c2a7e047867607f219fe8a9985f78)

>>> E:\Music.lnk - Malware > Deleted. (14.09.13. 07.52 Music.lnk.633947; MD5: 7780ea3c24bd7b0aea1ec52a118907fb)

>>> E:\Natalie- Love You So.lnk - Malware > Deleted. (14.09.13. 07.52 Natalie- Love You So.lnk.134854; MD5: a563c28347ee70c4efcc53a4a4f09dc1)

>>> E:\Sonata_Des_Cuilleres_DZed.lnk - Malware > Deleted. (14.09.13. 07.52 Sonata_Des_Cuilleres_DZed.lnk.660163; MD5: c1500a8ae71530082089015361108673)

>>> E:\AllMyLoveKata.lnk - Malware > Deleted. (14.09.13. 07.52 AllMyLoveKata.lnk.734169; MD5: 5a0f47fefcbcd0b240ef1ea706f59d75)

>>> E:\GlassFlowersKata.lnk - Malware > Deleted. (14.09.13. 07.52 GlassFlowersKata.lnk.373266; MD5: e8334b249306fce892d5aed5fa8dee00)

>>> E:\RoseAndButterfly.lnk - Malware > Deleted. (14.09.13. 07.52 RoseAndButterfly.lnk.633342; MD5: 569aae1ae5ec7bf211b5a16f135f3ccf)

>>> E:\Innocent.lnk - Malware > Deleted. (14.09.13. 07.52 Innocent.lnk.807580; MD5: dc1e02fe16cb746a16d53b5a6cd6ccb8)

>>> E:\GreenKata.lnk - Malware > Deleted. (14.09.13. 07.52 GreenKata.lnk.700974; MD5: ec10b28886ee513b3f0aee2688b7c738)

>>> E:\ButterflyKata.lnk - Malware > Deleted. (14.09.13. 07.52 ButterflyKata.lnk.48822; MD5: 8458a48aeb9601bdf25cb559aa8d997f)

>>> E:\spiral.lnk - Malware > Deleted. (14.09.13. 07.52 spiral.lnk.255416; MD5: e6945fd753c8d8d0b0815ffd22c9a514)

>>> E:\LoveKey.lnk - Malware > Deleted. (14.09.13. 07.52 LoveKey.lnk.623992; MD5: 97c4819ba4772a25f24217bc44ec6871)

>>> E:\GreenFairy.lnk - Malware > Deleted. (14.09.13. 07.52 GreenFairy.lnk.777983; MD5: b673112f856402f60646d89837f172f0)

>>> E:\Swirls.lnk - Malware > Deleted. (14.09.13. 07.52 Swirls.lnk.637178; MD5: c628caa8614716f3b53dc6c894d926b2)

>>> E:\The_Fray_-_over_my_head.lnk - Malware > Deleted. (14.09.13. 07.52 The_Fray_-_over_my_head.lnk.868918; MD5: f615d7dabcea871efe67f408ddfdf798)

>>> E:\Desktop.lnk - Malware > Deleted. (14.09.13. 07.52 Desktop.lnk.782297; MD5: 0e20d73d193e0c29a883e56af841db2b)

>>> E:\Folder.lnk - Malware > Deleted. (14.09.13. 07.52 Folder.lnk.681640; MD5: 7af748a587a01d6e5dbd0f19b4af34ed)

>>> E:\Beauty and madness -  MYMP.lnk - Malware > Deleted. (14.09.13. 07.52 Beauty and madness -  MYMP.lnk.6895; MD5: 76387ac6817c11712c5435eec5e4bec8)

>>> E:\FACEDAT.lnk - Malware > Deleted. (14.09.13. 07.52 FACEDAT.lnk.443605; MD5: d35133dcb0f199421c96fade7f1fbdf1)

>>> E:\sipkrzpmyl..vbs - Malware > Deleted. (14.09.13. 07.52 sipkrzpmyl..vbs.867897; MD5: c9c4d00a62ff4fc4597b74f4bdd41cf9)

>>> E:\pb.lnk - Malware > Deleted. (14.09.13. 07.52 pb.lnk.898213; MD5: 3a07197ccc625baf85d2eeed122fe92a)

>>> E:\lifeblog.lnk - Malware > Deleted. (14.09.13. 07.52 lifeblog.lnk.493620; MD5: c2bc908a97a6c6ca06d9149c0fd714a2)

>>> E:\Data.lnk - Malware > Deleted. (14.09.13. 07.52 Data.lnk.794022; MD5: 61102ab98f7b4cfa722be06efdf6c41e)

>>> E:\system.lnk - Malware > Deleted. (14.09.13. 07.52 system.lnk.160456; MD5: 7b4f556537c58d0df2c5efc01b6b2c74)

>>> E:\Images.lnk - Malware > Deleted. (14.09.13. 07.52 Images.lnk.202970; MD5: 92e79b9b591d3b0716a37294068711f6)

>>> E:\Videos.lnk - Malware > Deleted. (14.09.13. 07.52 Videos.lnk.703265; MD5: bab89fe8c0db1e9d762c5c8c8bd1ae16)

>>> E:\Private.lnk - Malware > Deleted. (14.09.13. 07.52 Private.lnk.657841; MD5: 6c2876b686eb37c1f9d97ff34bb04f63)

>>> E:\Sounds.lnk - Malware > Deleted. (14.09.13. 07.52 Sounds.lnk.585389; MD5: 8552767fa9504b54ba7515abbb0b8572)

>>> E:\Others.lnk - Malware > Deleted. (14.09.13. 07.52 Others.lnk.472789; MD5: be3d949ac6a5c9fca09eae7bdd077430)

>>> E:\sys.lnk - Malware > Deleted. (14.09.13. 07.52 sys.lnk.904338; MD5: 41699a4e2df1cb396459b5f8f9c4264a)

>>> E:\Documents.lnk - Malware > Deleted. (14.09.13. 07.52 Documents.lnk.393047; MD5: 0f0a6477be9c4ede615203afe5b931c5)

>>> E:\Backup.lnk - Malware > Deleted. (14.09.13. 07.52 Backup.lnk.868327; MD5: 272fad5b1b03ff3ad30eb60d4f03d67c)

>>> E:\muvee.lnk - Malware > Deleted. (14.09.13. 07.52 muvee.lnk.196469; MD5: 3d49073e3e1bc870c53d773633e15356)

>>> E:\DCIM.lnk - Malware > Deleted. (14.09.13. 07.52 DCIM.lnk.664665; MD5: 21ccf08fac3862849dceeb56193a2189)

>>> E:\DATABASE.lnk - Malware > Deleted. (14.09.13. 07.52 DATABASE.lnk.31317; MD5: d0082cd1ca6832dd99ebd68143411cd1)

>>> E:\desktop.ini - Suspicious > Renamed. (MD5: b62f6882eab2f08cbcff12a119b441e3)

>>> E:\folder.htt - Suspicious > Renamed. (MD5: 0f6320a81b05a288a34e731ff1b9d926)

> Resetting attributes: E:\pb < Successful.

> Resetting attributes: E:\lifeblog < Successful.

> Resetting attributes: E:\Data < Successful.

> Resetting attributes: E:\system < Successful.

> Resetting attributes: E:\Images < Successful.

> Resetting attributes: E:\Videos < Successful.

> Resetting attributes: E:\Private < Successful.

> Resetting attributes: E:\Sounds < Successful.

> Resetting attributes: E:\Others < Successful.

> Resetting attributes: E:\sys < Successful.

> Resetting attributes: E:\Documents < Successful.

> Resetting attributes: E:\Backup < Successful.

> Resetting attributes: E:\muvee < Successful.

> Resetting attributes: E:\DCIM < Successful.

> Resetting attributes: E:\DATABASE < Successful.


=> Malicious files   : 53/53 deleted.
=> Suspicious files  : 2/2 renamed.
=> Hidden folders    : 15/15 unhidden.
=> Hidden files      : 37/37 unhidden.

____________________________________________

::::: Scan duration: 5min 47sec ::::::::::::
____________________________________________




MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 7 <<<


9/14/2014 4:42:16 PM > Drive C: - scan started (OS_Install ~174 GB, NTFS HDD )...



=> The drive is clean.


9/14/2014 4:42:18 PM > Drive D: - scan started (Data ~116 GB, NTFS HDD )...



=> The drive is clean.


9/14/2014 4:42:18 PM > Drive W: - scan started (BIOS_RVY ~8 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 7 <<<


9/15/2014 1:36:44 AM > Drive C: - scan started (OS_Install ~174 GB, NTFS HDD )...



=> The drive is clean.


9/15/2014 1:36:46 AM > Drive D: - scan started (Data ~116 GB, NTFS HDD )...



=> The drive is clean.


9/15/2014 1:36:46 AM > Drive W: - scan started (BIOS_RVY ~8 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 7 <<<


9/15/2014 3:18:19 PM > Drive C: - scan started (OS_Install ~174 GB, NTFS HDD )...



=> The drive is clean.


9/15/2014 3:18:21 PM > Drive D: - scan started (Data ~116 GB, NTFS HDD )...



=> The drive is clean.


9/15/2014 3:18:25 PM > Drive W: - scan started (BIOS_RVY ~8 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 7 <<<


9/15/2014 4:20:26 PM > Drive C: - scan started (OS_Install ~174 GB, NTFS HDD )...



=> The drive is clean.


9/15/2014 4:20:29 PM > Drive D: - scan started (Data ~116 GB, NTFS HDD )...



=> The drive is clean.


9/15/2014 4:20:29 PM > Drive W: - scan started (BIOS_RVY ~8 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.4.12.1 / Windows 7 <<<


9/16/2014 9:31:22 AM > Drive C: - scan started (OS_Install ~174 GB, NTFS HDD )...



=> The drive is clean.


9/16/2014 9:31:23 AM > Drive D: - scan started (Data ~116 GB, NTFS HDD )...



=> The drive is clean.


9/16/2014 9:31:24 AM > Drive W: - scan started (BIOS_RVY ~8 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.9.14.1 / Windows 7 <<<


9/16/2014 12:49:45 PM > Drive C: - scan started (OS_Install ~174 GB, NTFS HDD )...



=> The drive is clean.


9/16/2014 12:49:48 PM > Drive D: - scan started (Data ~116 GB, NTFS HDD )...



=> The drive is clean.


9/16/2014 12:49:50 PM > Drive W: - scan started (BIOS_RVY ~8 GB, NTFS HDD )...



=> The drive is clean.





MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.9.14.1 / Windows 7 <<<


9/16/2014 1:24:32 PM > Drive C: - scan started (OS_Install ~174 GB, NTFS HDD )...



=> The drive is clean.


9/16/2014 1:24:34 PM > Drive D: - scan started (Data ~116 GB, NTFS HDD )...



=> The drive is clean.


9/16/2014 1:24:34 PM > Drive W: - scan started (BIOS_RVY ~8 GB, NTFS HDD )...



=> The drive is clean.



Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on September 26, 2014, 11:45:14 AM
How is the situation now?





 Please download TFC by OldTimer (http://oldtimer.geekstogo.com/TFC.exe) to your desktop
Title: Re: Shortcut virus - location: cmd (C:\Windows\System32) ????
Post by: REDACTED on October 01, 2014, 06:03:26 AM
Hey bro, i just did it. I hope this machine is okay now. Thanks a lot dude, you're the man. ;D