5 replies to this topic

[Rick1441]

Can a desktop internet shortcut I created myself, really be infected??? Malwarebytes is telling me that one was (I've deleted it, of course).

Although background may not be necessary to answer the question, here is some:

I have not been having any pc problems, although, I have had my NOD32 antivirus detect a few trojans lately -- one a fake AV, and a few days later "Probably a variant of Win32/PSW.Delf.NLS trojan."

In the first case there were a lot of "PC at Risk!" Fake AV popups. In the second case, the popups were so fast I can't even tell what they were for, but nothing seemed to be about a fake AV. And no virus was reported at first. I immediately started up another antispyware scanner (didn't have Malwarebytes at the time), but in less than a minute the computer rebooted itself, and when Windows XP came back up NOD 32 immediately detected and quarantined "Probably a variant of Win32/PSW.Delf.NLS trojan."

Ran a thorough CCleaner, Did some virus and scans and antispyware scans with the other anti-spyware problem, and all seemed fine.

Then I decided to see if Malwarebytes came up with anything. I did the Malwarebytes scan in Safe Mode and it found two "helper" registry keys infected with Vundo.H. They were quarantined.

After re-booting I went back into Malwarebytes in Safe Mode and did another scan, and it came up with this:

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32\ (Hijack.Tray) -> Bad: (C:\DOCUME~1\Richard\LOCALS~1\Temp\\shell32.dll) Good: (stobject.dll) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Richard\Desktop\Antivirus protection worse than a year ago - dslreports.com.url (Rogue.AntivirusPro) -> No action taken.


The latter was a shortcut I had placed on my desktop to the aforementioned web page at dslreports (from Firefox). It was entitled "Antivirus protection worse than a year ago." I got there via a link from h-online/security.

My pc has been performing normally all along, as far as I can tell, excpet of course during the active infections.

My main question: I've never heard of an internet shortcut being infected. My antivirus won't even scan them on-demand, as it will other files. Is this a false positive?

Thanks.

[Rick1441]

There were a couple typos near the middle of my post, but I don't see an edit option. But the intention should be obvious (e.g., meant "other anti-spyware PROGRAM, not "problem").

BTW, subsequent Malwarebytes scans have not reported any issues.

[GT500]

Please follow these instructions (skipping any steps you are unable to complete) for posting in our Malware Removal - HijackThis Logs forum. If you cannot follow any of those steps, then please create a new topic in that forum explaining what happened when you tried to run each of the tools in the instructions, and the expert who helps you will be able to suggest steps to take to get the tools working.

[Rick1441]

Thanks for the instructions. But before I proceed, I just want to make sure you understand that I am not having any issue with the pc (as far as I can tell, anyway), and that the Malwarebytes scan per instructions is now showing the system clean.

I was just trying to find out whether an infection can actually reside in an internet shortcut, as Malwarebytes reported for Rogue.AntivirusPro (no longer being reported -- I deleted it).

Or are you saying that what I've described suggests that some sort of infection may still reside on my system despite the appearance that it is clean, and that I should submit a Hijack This Log, anyway?

Regardless of your answer, I appreciate the replies.

[YoKenny1]

Rick, why clutter up the Desktop with shortcuts?

The Favorites in IE or Bookmarks are best for this plus they can be aranged in Folders for keeping topics organized.

In IE go to Favorites then Add to Favorites... then either create a New Folder or select an existing Folder.

[Rick1441]

YoKenny1 -

I create a desktop internet shortcut there is, say, something I did not get to finish reading, and I want to remember to get back to it. Or, say, something that describes a product or service I want to remember to look at in more depth later, and I feel I may never notice again if placed among all my bookmarks instead. The idea is that seeing it on the desktop will remind me. But your advice is still good for me because these shortcuts too often end up just sitting on the desktop indefinitely until I get around to doing some clean-up -- and much of it never ends up getting deleted or moved at all. So I do indeed need to avoid creating so many desktop shortcuts.

Rick