drive map launches notepad 1

[Midiean]

User clicks on a drive map, a specific drive map, as either a shortcut on the desktop or a link in my computer and it will launch notepad. Sality has been going around my office, but this system has come back clean. I say sality because this is one of the things that it does.

anyone have any ideas on how to rectify this issue since it comes back negative.

sality infects .pif files, the old icon files, however, .lnk files are used as shortcuts now.

any help would be appriciated at this point.

 

[guitarzan]

There was a recent thread on the same topic, maybe some help there:
thread779-1586008

 

[Midiean]

it was incredibly helpfull. that key pointed me to the infection source on our servers. it was set to open a hidden system file generated by sality in a volume that everyone in that department uses.

with in the mountpoints2 key, there were several paths that had additional keys within them. after inspection of these keys, they pointed me to the hidden file and it's autorun.

Thank you very much