Author Topic: I found a folder named "shylock" in d:\program files  (Read 2701 times)

0 Members and 1 Guest are viewing this topic.

FearRoar

  • Guest
I found a folder named "shylock" in d:\program files
« on: October 18, 2012, 05:20:50 AM »
Last night I found a folder named "shylock" in d:\program files, which only contains video games.  The shylock files are in the attachment now. (To open it, please change the extension ".txt" to ".rar", thank you.) The welogo.jpg is not a picture actually. If it is opened by .txt, some numbers show up. And When I double clicked the update.exe, a cmd window popped up and disappeared quickly. With a netizen's test, a window showed that "Application normal initialization (0x0000135) failed...".

I restart my pc last night and started some scanning with avast!, Dr.web and Spyhunter but without any clues. Then I forcibly delete it (with normal delete it shows that some files are used by some processes) with a software, but it appeared again when I started my pc this morning. And still cannot be deleted with normal methods.

I Google the word "shylock" and find it maybe one of the series of Trojan.shylock or the finance virus "shylock" came up a few days ago.

These are mainly features. Thanks for your scanning and please offer some help.

Last night I found a folder named "shylock" in d:\program files, which only contains video games.  The shylock files are in the attachment now. (To open it, please change the extension ".txt" to ".rar", thank you.) The welogo.jpg is not a picture actually. If it is opened by .txt, some numbers show up. And When I double clicked the update.exe, a cmd window popped up and disappeared quickly. With a netizen's test, a window showed that "Application normal initialization (0x0000135) failed...".

I restart my pc last night and started some scanning with avast!, Dr.web and Spyhunter but without any clues. Then I forcibly delete it (with normal delete it shows that some files are used by some processes) with a software, but it appeared again when I started my pc this morning. And still cannot be deleted with normal methods.

I Google the word "shylock" and find it maybe one of the series of Trojan.shylock or the finance virus "shylock" came up a few days ago.

These are mainly features. Thanks for your scanning and please offer some help.


Alright, now I find that this "shylock" folder was created by a NFS cheater.  The file is too big for me to upload.
« Last Edit: October 18, 2012, 06:56:10 AM by FearRoar »

Offline mikaelrask

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1556
Re: I found a folder named "shylock" in d:\program files
« Reply #1 on: October 18, 2012, 09:05:47 AM »
hey and welcome to the forum. if you think your still infected plaese follow this guide.

http://forum.avast.com/index.php?topic=53253.0

a malware expert will guide you from there.

good luck.
Windows 8.1 amd a10-5700 64 bit
12 GB ram 1 tb hard drive. Avast 18, MBAM