Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


*.LNKxxxxxx file extensions???

  • Please log in to reply
No replies to this topic

#1 CB-Lesh


  • Members
  • 1 posts
  • Local time:11:02 PM

Posted 02 August 2017 - 01:19 PM

I am working on a Windows 7 Pro x64 workstation. Core I7, 1TB HD, 8Gb RAM


In the root directory only, all *.exe files have been changed to *.LNKxxxxxx, where the "x"'s are a random combination of 5 or 6 letters and numbers, and are different on every file. For example, one file is  "MicrosoftWord.LNKso569" and another "MicrosoftExcel.LNKh3z376".


Some files are *.exe.LNKxxxxxx, and others do not include the ".exe"


*.exe's, nor any other file type, have been affected in any folders, including user or program folders.


I should note that this computer is part of a network that just got hit with the AMNESIA ransomware, which we are remediating on the server (emsisoft decryptor). None of the workstations were affected by the ransomware, but I found this issue during my investigative process. This is the only computer experiencing this file name issue. 


From a clean machine, so far I have run Norton, Malwarebytes, and SuperAntispyware on the drive and all have found nothing. 


Several google searches have also yielded zero results of anyone having this problem. It is not a standard file association issue, since it is relegated only to exe's located directly in the root directory on the c:drive.



BC AdBot (Login to Remove)


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users