Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Pen drive is becoming as shortcut

Created: 05 Jun 2013 • Updated: 05 Jun 2013 | 17 comments
vinu283's picture

Hi All

We Have around 350 clients running with sep 12.1 and in some system if you are connecting pendrive pendrive it self is becoming as shortcut and folders will be there as it is inside if you open that shortcut.  how to resolve this issue please help me

Note:Pen drive is becoming short cut not folders

Operating Systems:

Comments 17 CommentsJump to latest comment

technical_specialist's picture

Kindly update the system with latest defintion and patches

Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution

Vulnerability

Microsoft Security Bulletin MS10-046/ (KB2286198)

http://www.securityfocus.com/bid/41732/solution

Microsoft Windows Server Service RPC Handling Remote Code Execution

Vulnerability

Nortel Response to Microsoft Security Bulletin MS08-067/ (KB958644)

http://www.securityfocus.com/bid/31874/solution

*Edit*
Duplicate thread
 
W007's picture

check this thread

https://www-secure.symantec.com/connect/forums/sho...

Also can you provide SNAP shot for shotcut virus.

You can identify Virus file location (On Target)

Please paste full Target Path.when you find this path virus file you can submit file in symantec.

Shotcut.JPG

Check this artical

Eliminating viruses and security risks

Article:HOWTO27280  |  Created: 2010-01-08  |  Updated: 2010-01-15  |  Article URL http://www.symantec.com/docs/HOWTO27280

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

vinu283's picture

Hi technical_specialist

Those are up to date

 
technical_specialist's picture

analysis the file at "www.virustotal.com"

Kindly submit it to symantec, may be it is different virus.

http://www.symantec.com/security_response/submitsamples.jsp

https://submit.symantec.com/websubmit/retail.cgi

They can provide the rapid release defintion against this virus

vinu283's picture

Hi manish 

Plese find folowing attachments 

If you see the pen drive properties it will show you the following as target 

system32\rundll32.exe _WNGDKTQYIC.nil,rundll32

AttachmentSize
New Folder.rar 1.04 MB
technical_specialist's picture

Have you submitted the file to symantec?

Have you check the virus status at virus total?

May be this virus is not detected by symantec so you can submit ti to symantec for analysis.

W007's picture

Please enter full path

system32\rundll32.exe _WNGDKTQYIC.nil,rundll32

Also Provide Screen shot For machine

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

SameerU's picture

Hi

Can you please submit the shortcut file to Symantec Security response for analysing

Regards

Chetan Savade's picture

Hi,

This is a duplicate thread created by you, Could you please provide reason for the same?

https://www-secure.symantec.com/connect/forums/short-cut-virus#comment-8573761

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

.Brian's picture

See here

Eliminating viruses and security risks

Article:HOWTO27280  |  Created: 2010-01-08  |  Updated: 2010-01-15  |  Article URL http://www.symantec.com/docs/HOWTO27280

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Mithun Sanghavi's picture

Hello,

Have you created a Case with Symantec Technical Support?? It is adviced to create a case.

I would advise you to upload this suspicious file to the Symantec Security Response Team on - 

https://submit.symantec.com/essential

OR

http://www.threatexpert.com

Secondly in your case, it is advisable to follow few important steps:

1) Make sure all these machines are Patched with ALL Latest MS security patches and service packs.

2) Make sure the machines are installed with the Latest Symantec virus definitions.

3) Disable the Autorun Feature on the machine.

Preventing a virus from using the AutoRun feature to spread itself

http://www.symantec.com/business/support/index?page=content&id=TECH104447

Later, incase of suspicious activity still happening, then follow the steps provided in the Article below:

Using Symantec Help (SymHelp) Tool, how do we Collect the Suspicious Files and Submit the same to Symantec Security Response Team.

Here's some advice from Security Response on how to make the best use of SEP.  Auto-Protect with traditional AV derfinitions alone is not enough for a complete defence against today's sophisticated threats: using IPS, Insight etc is crucial.  And, of course, educated users following best security practice... that';s the best protection.

http://www.symantec.com/theme.jsp?themeid=stopping_malware&depthpath=0

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

Riya31's picture

in this case mostly exe file is exists in recycler folder which is hiddden.

unhide it and submit the file to symantec.

or else 

open command prompt-->browse to removable folder-->run following command Attrib /s | findstr SHR.

You will get a list running process. check for any .exe or .dll files running.

and submit it to symantec 

 
vinu283's picture

Hi Chetan

This is not a duplicate thread. in prvious case folders in side pen drive are becoming shortcut but in this case pendrive its self is becoming as shortcut and folders are remaining same ihave provided attachments also you can find out..

Regards

Vinod Kumar D

Chetan Savade's picture

Hi,

Could you please update this thread?

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

mofidul.talukder's picture

i am also finding out a solution for the problem below can any one.....

Currently i am using Norton Internet security,2013 for my desktop PC but whenever i insert my pen drive to USB port all file containing in the pen drive got shortcuted. After uncheck the hidden folder option i have found the original file which was in hidden format & Corrupted also.

Please help me

technical_specialist's picture

Kindly update the current status of your issue on the forum, if it resolved then mark the comment as solution which help you.