Re-Appearing Desktop Shortcut

[Guest]

I have a friend's PC that has a desktop shortcut that reappears all on its
own. I delete it, empty the recycle bin, re-boot, and there it is. The icon
is of IE, pointing to a specific web site.

The PC is running XP Pro, SP2. I've tried McAfee A/V and AntiSpyware, as
well as AdAware, Spybot, and other software in an attempt to eradicate with
no success.

I've done regedit and regedt32, looking for words in the name of the URL in
the shortcut throughout the registry and deleted.

Before I rebuild the thing, does anyone have a suggestion on what I can do -
either manually or with software?

Thanks.

 

[Fitz]

See if the entry is in c:\windows\prefetch. You can safely delete all files
in the Prefetch folder. Don't delete the folder itself.

 

[Guest]

Fitz,

Thanks for the reply. I tried what you suggested - deleted everything in
the prefetch folder, as well as the desktop shortcut. When I rebooted, the
shortcut came back.

More suggestions?

Thanks,

 

[Fitz]

Have you run all those programs in Safe Mode? Make sure System Restore is
off. HijackThis is also a good program to use (free) as well as BHODemon
(free). I don't know that these programs would help in your particular
problem. Just on an off chance, right click on the desktop, select
Properties, select Desktop, select Customize Desktop, select Web, and see if
anything in there is checked. Let us know.

 

[Guest]

Thanks again, Fitz.

I checked the desktop properties, and the only thing checked was "lock
desktop items". Unchecking had no effect.

I did run the software in Safe Mode. The PC has Ad-aware 6 Pro, but I
couldn't run it in Safe Mode - it wasn't there!!-??? Spybot found a few
things, but couldn't delete one dll. That I deleted manually.

When re-booting normally, the IE-shortcut icon came back. It's very
persistent. But then, so am I. I've got a little more time tonight and I'll
try the free-ware you suggested. Stay tuned ...

 

[Fitz]

What is this shortcut? What URL does it point to?

 

[Guest]

The shortcut is IE, and it points to a on-line casino web site.

I contacted the target web site about the problem, and they suggested I try
spyware and adware disinfecting software.

As for the share ware you suggested. No help. It found some stuff, but I
still get the shorcut on re-boot. I ran them in normal mode and in safe mode.

This thing is really a pain. I'm about ready to rebuild the drive.

 

[Fitz]

Does this shortcut appear when you start in "Safe Mode"? You might Google
for a free program called StartUp Manager. There are a lot of programs
called that...some are free, others are not. Have you checked the Services
listed in Administrative tools to see if any suspicious items are in there?
How about services that are listed in Task Manager?

Hang in there!

 

[Guest]

SUCCESS!!!!! The StartUp Manager was the ticket. The icon appeared in
normal boot up, but not in Safe Mode. From there, it was just a process of
elimination using the StartUp Manager to isolate the bad boy. Once I had the
exe identified, I did go in and take care of the Registry. The exe had even
found it's way into the firewall registry under "last site visited" or
something like that. Nasty little sucker.

Now that I have the little bugger on a floppy, any suggestions on where to
send it? I'm a little surprised that none of the mainstream anti-everything
software ID'd it at all.

To use a motor-head term, the PC now runs like a raped ape!

Thanks, Fitz. You da bomb!!

 

[Fitz]

Glad it finally worked for you! You can send the file to this site for
scanning: http://www.virustotal.com/flash/index_en.html. I've not used the
site before but have heard good things about it.

Have a good day!