Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On my Vista PC the Firefox shortcut icon is being randomly renamed. The name changes to some variation of a recently visited URL. This unwanted action has survived several version updates. Of course I suspect a possible malware issue but as an IT professional I have tested many AV/AntiMalware programs on this PC over time which have not found any issues. I have also tried a variety of related file attrib changes without success. As this is an administrative PC I hate to to think that it might be spreading a well hidden malware instance, perhaps more damaging than just this nuisance symptom. Any thoughts?

PS Appreciate the lucid and practical information presented on this site. Well done.

share|improve this question
    
Have you just tried deleting the shortcut altogether for awhile, to see if it comes back up? Have you deleted and re-created the shortcut, or always just renamed? –  Iszi Jun 3 '11 at 18:55
2  
Are you sure the shortcut is for Firefox and not for some html file (which will be show Firefox' icon since it's the default handler of html files)? –  Eugen Constantin Dinca Jun 4 '11 at 2:43
    
Hi @PMI, welcome to the site! –  AviD Jun 7 '11 at 15:46
add comment

1 Answer

To try to identify what's going on, I suggest the Sysinternals process monitor. Add a filter for file access and see if you can find what is touching it. If that doesn't show it, check for rootkits. If that doesn't show it, somebody thinks you're special and you've got something relatively unique going on.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.