Author Topic: Avast endpoint protection suite and shortcut Virus regenerated  (Read 4531 times)

0 Members and 1 Guest are viewing this topic.

Offline nabil.noussair

  • Newbie
  • *
  • Posts: 1
Avast endpoint protection suite and shortcut Virus regenerated
« on: October 25, 2016, 12:08:50 PM »
Hello

I am infected with a virus known enough, who do your shortcut folder
The problem is not on a USB key, but the DATA partition of my windows. (Windows server 2012).
So I use several software such as USB fix, malwarebytes, RogueKiller ...
Here the infected file:
This file is in the registry, it regenerates it permanently.

more when I right click on an infected shortened, the target is C: \ Windows \ system32 \ cmd.exe / c start wscript /e:VBScript.Encode Manuel.doc
so I remove MANUEL.DOC, but it constantly regenerates.

I use Avast Endpoint Protection Suite detects nothing;


Can you help me because I'm blocked.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31343
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: Avast endpoint protection suite and shortcut Virus regenerated
« Reply #1 on: October 25, 2016, 12:11:35 PM »
Looks like the Forbix worm to me.
Spreads through removable media and network drives.

Real easy to stop and remove.
Call your admin and have him remove it.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 36794
Re: Avast endpoint protection suite and shortcut Virus regenerated
« Reply #2 on: October 25, 2016, 12:14:18 PM »
You may try 

Anti-VBS/VBE > http://www.mcshield.net/download/tools/Anti-VBSVBE/

For USB protection MCShield > http://www.mcshield.net/