Virus that changes program extensions to .lnk?

Posted on 2009-04-08
Last Modified: 2013-11-16
My computer started having fits last night, first with Lavasoft alerting about changes to registry keys (all of which I blocked).  Then games like solitaire and hearts became unable to open.  When I went to Start/Programs/Games to open them, the icons were gone/replaced, and the file extensions were changed to .lnk.  Then it started to cascade to other programs, so I shut the system down.  I had Norton AV, but the script had just expired yesterday, and I was in the process of renewing it when all this happened.  Norton AV is now also a .lnk extension.  What is happening?  And how do I fix it?  Thanks!
Question by:blueminnow
  • 6
  • 4

Expert Comment

ID: 24097330
-Temporarily uninstall Norton.
-Temporarily turn off System Restore (right click "My Computer", click on System Restore tab)
-Download and install AVG Free (
-Download and install MalwareBytes (get it from
-Download and install Spybot S&D (also from
-Download and Run CCleaner (
-Go to Start-->Run and type "sfc /scannow" (without quotations)

Report back with what types of infections found.

Author Comment

ID: 24100748
Thank you.  I'll give this a try tonight (it's my home computer).

Author Comment

ID: 24106324
Hi tplaya07,

I downloaded all the apps to a flash drive and took them home, then loaded them onto my laptop.  However, that's basically as far as I could go.  I cannot uninstall NAV, or do anything else, as all of the commands no longer work.  I can see things, like in Control Panel, but cannot access them.  All of my documents are intack, but that's the only good news.  None of the apps would load, no matter which method I tried.  Any other suggestions....or is the goose cooked and we need to take it somewhere?  Thanks for the help.  Kathy
Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.


Expert Comment

ID: 24107670
OK.. go to the link below, click on "Win XP Fixes" on the left, click "File Association Fixes", and then download "EXE File Association Fix" and "LNK File Association Fix"

Since you'll probably have to download these from another PC onto your flash drive, you might as well go ahead and download all of them and name them appropriately. They are all very small files.

When you try and open these files from your computer, it may ask what program you want to use to open them with, just browse to C:\windows\regedit.exe

Author Comment

ID: 24109152
Thanks, will give this a go.

Author Comment

ID: 24114805
I managed to get 'exe file association fix' and lnk file association fix' onto the desktop of my laptop.  Unzipped 'LNK...", but could not unzip 'EXE_XP_ fixes'...that one read "no files found".

I ran the sft/scannow, and a Windows File Protection window appeared stating that it was 'verifiyng all protected Windows file are intact and in their original versions."   This got about 20-25% complete when the system shut down.  

I didn't have the opportunity to deal with it further, but will do so tonight.  Some of the desktop icons reappeared and their programs were functioning, so I have great hopes.  Will also install the cleaner.  Will let you know what happens.  Thanks for your help so far.

Accepted Solution

tplaya07 earned 500 total points
ID: 24117755
Glad things seem to be going in the right direction. You could try downloading and unzipping those files at another computer, putting them on a CD or USB drive, and then loading them on your computer. We'll probably have to get all the file associations fixed before we proceed on to the sfc and other scans.

Author Comment

ID: 24141988
Sorry for the delay....I was home yesterday downloading the updates at 21.6 kbps.  It was like watching hair grow.

I loaded and ran SpyBot, CCleaner, AVG, MalBytes, and "EXE File Association Fix" and "LNK File Association Fix".  I opened the latter 2 files w/ C:/Windows/regedit per your instructions.  Ran all the other programs, and they found a bunch of stuff (see attached logs) which I quarantined/deleted.  Then I ran sfc /scannow.  It finally worked!  I'm assuming that everything is okay with that as it did not give me any kind of message to the contrary.  

Things seem to be running pretty smoothly now (keeping my fingers crossed!).  The only thing I can't seem to fix so far is the right-hand portion of the task bar where the active programs should be.  It used to have a little button where you could expand it to see all the active programs, but no longer.  The only items showing up are the time/date, AVG, SpyBot, and Malbytes, and the HP imaging icon.  Missing is my network connection, my internet connection, and any other programs which I'm running.  I've gone into Control Panel, Start Menu/Task Bar and made changes, but none of these changes take effect.

Any idea on how to fix that?  Other than that, things are working well.  And I thank you so much!

Author Closing Comment

ID: 31567999
Thanks a million!  Who knew all those resources were out there, not to mention that you knew what I was talking about.  Much appreciated!!

Expert Comment

ID: 24148132
Glad to hear things are running better. To verify that your system is clean, can you post a HijackThis log (

As for the Taskbar issue, which area is it that's affected? I believe you're referring to the System Tray circled in green below, but just want to make sure.

Try right-clicking on your Start button, select Properties, click the Taskbar tab, and at the bottom place a check next to "Hide Inactive Icons". This option determines whether to show ALL items/programs running (unchecked box), or only show some of the programs running but place an arrow next to them to be able to expand and show all (box is checked).

As for the Network Connection icon not showing up, you can try going to Start-->Control Panel-->Network Connections, and then right-click on the icon that says "Local Area Connection" (I'm assuming your using a hardwired connection) and click Properties. Place a check next to "Show icon in notification area when connected". This will make the icon appear next to your clock in the System Tray.

I'm not sure what you mean when you say that "my internet connection, and any other programs which I'm running" isn't showing up. Do you mean their not showing up on the TaskBar (red circle) or System Tray (green circle)?

Featured Post

Networking for the Cloud Era

Join Microsoft and Riverbed for a discussion and demonstration of enhancements to SteelConnect:
-One-click orchestration and cloud connectivity in Azure environments
-Tight integration of SD-WAN and WAN optimization capabilities
-Scalability and resiliency equal to a data center

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
This story has been written with permission from the scammed victim, a valued client of mine – identity protected by request.
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question