Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have encountered a supposed low level eploit on my network at work, by the name of: Exploit.LNK.BadLnk.a (v). I have torn through pages of entries on google trying to find information on this bit of malware. The only entry that actually pertains to this one points to a report on with an entry but no information on it or removal. So now I ask, has anyone here come across this one and successfully removed it?

share|improve this question
There seems to be a distinct lack of information on this variant in any of the reputable and available databases that I have access to which is extensive. Can you tell me the name of the tool that you used which generated the name, or how you identified this - as often the naming convention can be slightly subjective. – GµårÐïåñ Sep 26 '13 at 22:14
This showed up in Quarantine via VMProtect, upon discovery we deleted but it keeps cropping up, throughout the network. – Rippyhick Sep 26 '13 at 22:17
Are you using the VMPSoft version or the Acronis? – GµårÐïåñ Sep 27 '13 at 5:53
VMProtect, now owned by Shavlik not VMWare, for Malware active protection and Patching. We do use Acronis but only for imaging. – Rippyhick Sep 27 '13 at 13:56
Yeah VMWare doesn't own it, just asked because VMPSoft has one and Acronis has one, just wanted to know which particular one you are using. So its the one from Shavlik, assuming Shavlik Protect then? I am trying to narrow it down so I can check their engine and see what's what. – GµårÐïåñ Sep 27 '13 at 19:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.