Endpoint Protection

When u insert my pendrive in my system my all folder being shortcut and i cant able to open it.

I'm using symante endpoint protection 11.1,

Please give me solution

Have you antivirus update with lates defintion?

Microsoft Security Patches Updated?

Check thread

https://www-secure.symantec.com/connect/forums/shortcut-folders-creating-virusworm

Update patches

hi,

Check same problem releated Thread

https://www-secure.symantec.com/connect/forums/short-cut-virus

Have you scanned the drive for an infection? Is SEP not detecting anything?

You can submit the file here:

https://submit.symantec.com/websubmit/gold.cgi

Update your system with Latest Defintion.

Make sure your system are update with Latest MSPatches.

Scan your system in safemode.

If it not be clean then submit the suspicious files to symantec security team

http://www.symantec.com/security_response/submitsamples.jsp

Collect the log and also submit to symantec

https://www-secure.symantec.com/connect/articles/using-symantec-help-symhelp-tool-how-do-we-collect-suspicious-files-and-submit-same-symante

Shortcut virus are create some Microsoft patch are missing in your system.

You can check some of fourms for same problem releated

https://www-secure.symantec.com/connect/forums/short-cut-virus

https://www-secure.symantec.com/connect/forums/vir...

HI, 

Update your System as well the OS and run a full scan on safe mode. And let us know the outcome.

Regards

Ajin

Hello,

Check this thread

https://www-secure.symantec.com/connect/forums/all-folder-pendrive-become-ink-or-shortcut#comment-8858501

https://www-secure.symantec.com/connect/forums/pen-drive-becoming-shortcut#comment-8830881

Hello,

W32.Changeup.C  is a worm that spreads through removable and shared drives by exploiting the Microsoft Windows Shortcut 'LNK' Files Automatic File Execution Vulnerability (BID 41732).

W32.Stuxnet!lnk is a detection for .lnk files created by the W32.Stuxnet worm.

Bloodhound.Exploit.346 is a heuristic detection for files attempting to exploit the Microsoft Windows Shortcut 'LNK' Files Automatic File Execution Vulnerability (BID 41732).

New Trojan.Shylock wave

https://www-secure.symantec.com/connect/blogs/new-trojanshylock-wave

The Shylock “LNK” Awakening

https://www-secure.symantec.com/connect/blogs/shylock-lnk-awakening

Could you please zip each of the files and submit the zip files (without password) to the Symantec Security Response Team on : 

https://submit.symantec.com/websubmit/essential.cgi

We also offer a self-service site to analyze files, at http://www.threatexpert.com, which can give you more information on the files you submit to it.

Check these Articles:

What to do when you suspect that a Symantec AntiVirus product is not detecting viruses

http://www.symantec.com/docs/TECH99222

Using Symantec Help (SymHelp) Tool, how do we Collect the Suspicious Files and Submit the same to Symantec Security Response Team.

https://www-secure.symantec.com/connect/articles/using-symantec-help-symhelp-tool-how-do-we-collect-suspicious-files-and-submit-same-symante

So, as we see these above Threats appears when there are open vulnerabilities on the machines.

In your case, I would suggest the below Plan of Action:

1) Make sure ALL Computers are installed with Symantec EP with latest / updated with virus defintions.

2) Install ALL Latest Microsoft Secuirty Patches / Sevice Packs on ALL machines.

3) Make sure ALL the client machines are using the Latest Vendor Patches installed.

4) Disable Auto play with GPO

http://support.microsoft.com/kb/953252

5) Disable the System Restore with GPO

http://support.microsoft.com/kb/283073

6) Disable Scheduled Tasks with GPO

http://support.microsoft.com/kb/310208

7) Incase of any shared / mapped drives present, make sure these are password protected.

8) Scan ALL the machines...

Here are some excellent suggestions on how to keep your computers, their users and data safe:

http://www.symantec.com/theme.jsp?themeid=stopping_malware&depthpath=0

Hope that helps!!

Please update the current status in thread or mark as Solved with the helpful one.

Thanks All Dear, But I Didn't Try this

But I ll Try recently

Any update on this thread?

This user is no longer active