Author Topic: LNK Jenxcus-D [Trj] Virus on USB-Stick  (Read 849 times)

0 Members and 1 Guest are viewing this topic.

Offline pcbroken123

  • Newbie
  • *
  • Posts: 9
LNK Jenxcus-D [Trj] Virus on USB-Stick
« on: June 30, 2020, 02:08:56 AM »
Hello,

Yesterday I copied some files from another PC onto my USB-stick. When I plugged in the USB in my PC, Avast immediately alerted me that ALL files on my USB-Drive are infected with the LNK Jenxcus-D Virus, and moved these Files into the Virus Chest. All Files and Folders seem to now have .lnk ending in the Virus Chest.

Is it possible to save/clean the Files from the Stick without losing them?

Any help would be appreciated!

** I am unsure which program logs i should upload to help diagnose/ fix the problem?

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 36760
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #1 on: June 30, 2020, 10:48:17 AM »
Quote
** I am unsure which program logs i should upload to help diagnose/ fix the problem?
all listed here, including SPECIFIC INFECTIONS LOGS  >>  https://forum.avast.com/index.php?topic=194892.0



Offline pcbroken123

  • Newbie
  • *
  • Posts: 9
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #2 on: June 30, 2020, 02:38:02 PM »
Thanks for the replay, here are the Malwarbytes, FRST and MCshield logs
« Last Edit: June 30, 2020, 02:41:42 PM by pcbroken123 »

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 36760
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #3 on: June 30, 2020, 05:16:58 PM »
Your USB stick was infected with this
https://www.virustotal.com/gui/file/502cf74547e727416b051eef9d42d809c803ea1beffc13352514acbedb8ad794/detection

Quote
Yesterday I copied some files from another PC onto my USB-stick.
This computer is infected


@Sass Drake will give instructions when he is online




Offline pcbroken123

  • Newbie
  • *
  • Posts: 9
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #4 on: June 30, 2020, 07:14:09 PM »
oki doki, thank you

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 826
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #5 on: June 30, 2020, 09:08:27 PM »
Another PC is infected but this PC is not according to logs.
Open USB disk in File Explorer, hold Shift button and right click on empty space. You will see option Open PowerShell windows here and click on it. (holding Shift is no longer required).
Type:
Code: [Select]
attrib -s -h *
and press Enter.

Offline pcbroken123

  • Newbie
  • *
  • Posts: 9
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #6 on: June 30, 2020, 09:20:34 PM »
Ok, i just did this and the following files appeared on my usb stick:

autorun.inf.vir
bootmgr
bootmgr.efi
setup
systemstick.exe.vir

What are these files and can i delete them? The files that were on the usb stick but got infected, is there anyway to safely get them back?

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 826
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #7 on: June 30, 2020, 09:35:44 PM »
Folders and files hidden by USB worm should be visible on USB disk after that command. Filenames you wrote belongs to Windows installation media and you can delete them if you wish. Also try this wo show hidden files and folders in File Explorer.

https://thegeekpage.com/how-to-view-hidden-system-files-in-windows-10/

Offline pcbroken123

  • Newbie
  • *
  • Posts: 9
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #8 on: June 30, 2020, 09:43:09 PM »
Folders and files hidden by USB worm should be visible on USB disk after that command. Filenames you wrote belongs to Windows installation media and you can delete them if you wish. Also try this wo show hidden files and folders in File Explorer.

https://thegeekpage.com/how-to-view-hidden-system-files-in-windows-10/

Ok thank you!
Now i can see the files/folders that were on the stick, but they are now greyed out. Is it safe to open these files/folders? Or are they not infected with the virus?
« Last Edit: June 30, 2020, 09:46:10 PM by pcbroken123 »

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 826
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #9 on: June 30, 2020, 09:52:15 PM »
It means they are hidden and you can open them.

Please repeat PowerShell instructions with this command:

Code: [Select]
attrib -s -h *.*

Offline pcbroken123

  • Newbie
  • *
  • Posts: 9
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #10 on: June 30, 2020, 10:14:37 PM »
ok, i repeated the powershell and entered the code like you said, but didnt notice anything different. So i have opened these files and also copied them onto a hard drive, i assume they are safe now and no longer infected.

i should probably remove the "show hidden files" now that i do not need it anymore. Is there anything i have to do in the powershell command to return everything to normal?

and i assume i can use my usb as normal now, right?

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 826
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #11 on: June 30, 2020, 10:22:15 PM »
Try this one in root of USB drive:

Code: [Select]
attrib -h -r -s *.*

Offline pcbroken123

  • Newbie
  • *
  • Posts: 9
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #12 on: June 30, 2020, 10:41:50 PM »
Try this one in root of USB drive:

Code: [Select]
attrib -h -r -s *.*

still seeing no change... :o

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 826
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #13 on: June 30, 2020, 11:33:16 PM »
I have no more ideas. :(

Offline pcbroken123

  • Newbie
  • *
  • Posts: 9
Re: LNK Jenxcus-D [Trj] Virus on USB-Stick
« Reply #14 on: July 01, 2020, 11:52:40 AM »
I have no more ideas. :(

all good, thank you very much for your help so far :D

i have now been able to access the files that were on the stick, so that problem has been solved.
Is the usb stick now virus-free and usable again?? if it is, then the problems have been solved! :D