desktop.ini

[davidleite94]

Hello, buddies.
That's my very first post on this forum, and I'm here to ask for help after trying a bunch of other stuff. I got caugth by a Ransomware recently, and I decided to use the system recovery (my computer is a Dell so it has a factory reset). But after doing so, my computer is showing a file called "desktop.ini" in a lot of folders. Also, if I delete it, it always comes back. I guess it infected my recovery partition as well. Sometimes, the recovery partition shows up on the explorer when I access the Windows Explorer. What can I do about it?

[Aura]

Hi davidleite94

desktop.ini isn't malicious, it's a file that stores display/view settings for the current folder it is located in. It'll always be recreated by Windows when it gets deleted.

http://www.digitalcitizen.life/why-are-there-two-desktopini-files-my-desktop-what-do-they-do

To hide them, follow the instructions in the link above and make sure that "Hide protected operating system files (Recommended)" is checked. Then they should dissapear.

[davidleite94]

I didn't said so, but there are some shortcuts being created in some folders, like Users, Program Files, ProgramData and AppData. They are created when I do the system restore and when I click on some folders like System Volume Information and $Recycle.Bin. The Recovery partition also shows up sometimes, when I restart my computer. I think that's some strange behavior.

[Aura]

Quote

but there are some shortcuts being created in some folders

What shortcuts?

Quote

Users, Program Files, ProgramData and AppData

These are all legitimate Windows folders.

Quote

when I click on some folders like System Volume Information and $Recycle.Bin.

These are legitimate Windows folders as well, though they are system folders.

Quote

I think that's some strange behavior.

It isn't strange. It looks like your System Restore disabled the option to hide protected operating system files. If you enable it (by following the instructions I provided above), these will be hidden once more, and your view will turn back to what it was before.

[Aura]

Hi davidleite94,

Are you still with me?

[davidleite94]

I tried what you said. But it doesn't solve it, what keeps making me think that this is not normal. Also, when I copy files from my computer to clouds or pendrives or other one's computers, desktop.ini also shows up on other computers. I've read about this in a lot of other posts, everybody saying it is normal, but I really don't think so. I'll just let it go since no one knows how to solve this.

Edited June 12, 2017 by davidleite94
One wrong letter.

[Aura]

Is it normal. The desktop.ini file isn't malicious, nor is it related to an infection. What might be happening however is that your desktop.ini files lost their "System" file attribute, which means that they won't hide even if you check "Hide protected operating system files (recommended)".

Let's see if that's the case. Follow the instructions for FRST in the thread below, and provide me the FRST.txt and Addition.txt logs.

https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

 

[davidleite94]

There ya go.

Addition.txt

FRST.txt

[Aura]

I don't see any desktop.ini files listed in your logs, though I can see a few browser hijacks which we will remove.

Also, I see that you have two Antivirus installed: AVG and McAfee. You should never have more than one Antivirus installed at the time on a system, since having more than one can create system instability and conflict. So I would uninstall one of them, and keep the other (ideally, keep the on you're presently paying for).

Farbar Recovery Scan Tool (FRST) - Fix mode
Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located);
• Right-click on the FRST executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• Click on the Fix button;
  
• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad;
• Copy and paste its content in your next reply;
  

fixlist.txt

[davidleite94]

Ok, I'm gonna do it when I get home, but there's another computer that I use at work and it might be infected by hijacks as well. I already scanned it, there goes the files (if you can help me out).

Addition.txt

FRST.txt
 

EDIT for these ones, I can answer quickly.

Edited June 12, 2017 by davidleite94

[Aura]

Quote

but there's another computer that I use at work and it might be infected by hijacks as well.

Is that your computer or your employer's computer? If it belongs to your employer, are you allowed to seek assistance for it online, and not from your IT department? Just making sure.

[davidleite94]

It is mine. It's fine.

[davidleite94]

When it finished, it asked me to restart the computer. I guess that that's the log, I'll paste what's on it:

Resultado da Correção pela Farbar Recovery Scan Tool (x64) Versão: 12-06-2017
Executado por david (13-06-2017 01:14:17) Run:1
Executando a partir de C:\Users\david\Downloads
Perfis Carregados: david (Perfis Disponíveis: david)
Modo da Inicialização: Normal
==============================================

fixlist Conteúdo:
*****************
CloseProcesses:
CreateRestorePoint:

ProxyServer: [S-1-5-21-3541513695-1080155128-3958550182-1001] => proxy.facip.ufu.br:3128
CHR StartupUrls: Default -> "hxxps://www.facebook.com/","hxxp://www.google.com/","hxxp://www.startpageing123.com/?type=hp&ts=1490263764&z=53aecd22f8a673ba1cee4d9g3zet6eaoaq1c6mcq4q&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WX51A169603E9603E"

EmptyTemp:
*****************

Processos fechados com sucesso.
Ponto de Restauração criado com sucesso.
HKU\S-1-5-21-3541513695-1080155128-3958550182-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => valor não encontrado (a).
Chrome StartupUrls => removido (a) com sucesso.

=========== EmptyTemp: ==========

BITS transfer queue => 7364608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 45865945 B
Java, Flash, Steam htmlcache => 933 B
Windows/system/drivers => 5738041 B
Edge => 3592437 B
Chrome => 793621741 B
Firefox => 12037277 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 1102507 B
systemprofile32 => 0 B
LocalService => 12412 B
NetworkService => 1694 B
david => 479640821 B

RecycleBin => 6296226 B
EmptyTemp: => 1.3 GB de dados temporários Removidos.

================================

O sistema precisou ser reiniciado.

==== Fim de Fixlog 01:16:08 ====

[Aura]

And this is a fix for your work computer. Also same advice for it: uninstall one of the two Antivirus installed, and keep the other. You also have two firewall installed: McAfee and ZoneAlarm, so uninstall one as well.

Farbar Recovery Scan Tool (FRST) - Fix mode
Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located);
• Right-click on the FRST executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• Click on the Fix button;
  
• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad;
• Copy and paste its content in your next reply;
  

 

fixlist.txt

[Aura]

Hi davidleite,

Are you still with me?

[davidleite94]

Hey!
I forgot to send you the log, and since Thursday was holiday in my country (I'm Brazilian) I'm not working today as well (we call this extended holiday). I thank you a lot for your help, and this post can be shut down now

[Aura]

No problem david, you're welcome

Enjoy your day off!

[Aura]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!