Linkinfo.dll

Last Updated on Sunday, 10 June 2012 14:53 Friday, 03 April 2009 08:15

linkinfo.dll is a legitimate Microsoft windows file foud in the system directory, that is C:\Window\system32 folders.You can also see it in some backup hidden system folders as seen in the image.

If you use the windows search utility to search for this file, and then take your mouse pointer over it, it should display the information about the file. It's description says "Windows volume tracking"

The name Linkinfo.dll has been used by several malicious viurs installers. I will list all the analysis reports below in Chronological order. Latest at Top and earlier at bottom. Please see the reports if you suspect one of the variants has infected your computer.

# Creates C:\Windows\linkinfo.dll see report

# Creates C:\windows\system32\dllcache\linkinfo.dll see report

# Creates %Temp%\WINDOWS\linkinfo.dll see report

# Creates %UserProfile%\WINDOWS\linkinfo.dll see report

The viruses creates Linkinfo.dll and other files on the infected computer that you need to search and delete. You should end running processes named Linkinfo.dll from Task Manager. And also remove the file's entries from windows startup.

The removal process may require using System Restore, Enabling to view Hidden files and folders, Removing entries from Windows Startup, Booting in Safe Mode, Using System File Checker etc. These steps are slightly different for different versions of Windows.

Some steps are essential

# Remove virus processes from the Task Manager
# Search and Delete virus files from the hard disk. You may have to enable to view Hidden FIles before you search otherwise virus files inside the windows system folders will not be searched.
# Remove obsolete registry keys using CCleaner

Detailed instructions and a number of free Tools are listed on this link.

You may also look at different ways to prevent malicious files from entering your computer on this link.

Reprinted with permission from Threatexpert.com

Warning: Before you proceed, Please see the Disclaimer

Sanjay C Rajure