W32.Stuxnet!lnk

24 July 2010 Virus 1 Comment

W32.Stuxnet!lnk is a detection for .lnk files created by the W32.Stuxnet worm. These .lnk files will exploits the “Microsoft Windows Shortcut ‘LNK’ Files Automatic File Execution Vulnerability”  to be able to execute the files created by the worm. Malicious files will be spread by copying itself on removable drives found on infected computer.

The virus may be downloaded by other threats from a remote site and run on target computer unnoticeable to anti-virus program. When executed, malicious routines by this virus are exhibited on the contracted system and spread if a USB removable drives are used.

Alias: Troj/Cplink-A, LNK_STUXNET.A, W32.Temphid!lnk, Stuxnet!lnk

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

How to Remove W32.Stuxnet!lnk:

FIRST AID TO STOP W32.Stuxnet!lnk:
If this virus have infected the system, registry and legitimate Windows files are also compromised. System Restore can reinstate clean system files by restoring the configuration to an earlier date. If a restore point was created before you got infected with W32.Stuxnet!lnk, please restore Windows to previous configuration.

REMOVAL TOOL for W32.Stuxnet!lnk:
1. Click here to download removal tool. Save it on your Desktop.
2. After downloading, double-click on the file to install the application.
3. Follow the prompts and install as “default” only
4. If it prompts to update the database after installation, please proceed.

5. Click “Finish.” Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
6. Scan your computer thoroughly.
7. When scanning is finished, click on the “Show Results”
8. Make sure that all detected threats are marked, click on Remove Selected.
9. Restart the computer.

Note: W32.Stuxnet!lnk may prevent mbam-setup.exe from downloading and running. You can download and rename this program from a different computer before running it on infected system.

MANUAL REMOVAL OF W32.Stuxnet!lnk:
1. Update installed anti-virus application to have the latest definition file.
2. Reboot Windows in Safe Mode
- After turning on the power, press F8 on the keyboard.
- Select Safe Mode from the menu.

3. Thoroughly scan the system and clean/delete all infected file(s).
4. Exit registry editor and restart Windows.

ADDITIONAL TOOLS AND PROGRAMS:

MalwareBytes Flash Scanner:
The Trojan will propagate by means of USB removable drives. It is important to scan the media before using. MalwareBytes AntiMalware have included a Flash Scanner on registered version to scan and remove threats residing on external media devices.

Scan with Norton Power Eraser:
A free removal tool from Norton Antivirus was developed to remove virus and unfamiliar threats without using the traditional AV signatures. Download the tool from this location and start scanning the computer for viruses.