I have a very curious question.

Periodically, the shortcut links on my desktop have their targets replaced to link to shutdown.exe, or more specifically..

%windir%\System32\shutdown.exe -s -f -t 00

Now, I have no idea why this happens. And it's happened basically since I built this box about 6 months ago. Usually I navigate through start menu, and given I'm wise to this trickery, I check my desktop shortcuts before clicking them.

There doesn't appear to be a pattern. They aren't deleted applications, they aren't from the same publisher. Got nothing.

Any ideas?

  • 1
    Do you have any "friends" who also use your computer? – grawity Oct 11 '18 at 15:01
  • None smart enough to do it I believe. And it's like 1 person who has access. Also I'd believe that if they where hitting things that would make sense. But switching my "SourceTree" link? Why? – CP510 Oct 11 '18 at 15:03
  • 2
    Looks like a spyware behavior, like the in the days of WinXP when the ThumbDrives would get their files hidden and replaced with symlinks for installing the spyware in the pc. Have you run some tests with SpyBot or HijackThis? – dmb Oct 11 '18 at 15:25
  • No I didn't run any tests. I figure its benign considering that is just the actual shutdown command, and nothing in registry or startup suggests it's trying to get a boot time program to start. – CP510 Oct 11 '18 at 15:41
  • 1
    Some viruses are created by script-kiddies from packages available on the Internet. These viruses are sometimes pretty inapt and do dumb things. I suggest deep antivirus scans by at least two well-known products (I like Malwarebytes). – harrymc Oct 11 '18 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.