Author: JNalducci
Subject: EXCEL.EXE is creating strange folders
Posted: 17 April 2013 at 2:43pm
Update April 4 2013
After weeks of working with our antivirus software team we still have not found any clue to this behavior.
The only new info to report is I captured with process monitor that excel opened DLL called linkinfo.dll from the desktop instead it's normal location in the system folders. As soon as I checked the desktop for the DLL it was not there or on the public desktop.
The excel file in question that all the infected users use was tested as clean from the antivirus software security team.
We still see this activity and it can move to new machines.
Will update when we know more.
Subject: EXCEL.EXE is creating strange folders
Posted: 17 April 2013 at 2:43pm
Update April 4 2013
After weeks of working with our antivirus software team we still have not found any clue to this behavior.
The only new info to report is I captured with process monitor that excel opened DLL called linkinfo.dll from the desktop instead it's normal location in the system folders. As soon as I checked the desktop for the DLL it was not there or on the public desktop.
The excel file in question that all the infected users use was tested as clean from the antivirus software security team.
We still see this activity and it can move to new machines.
Will update when we know more.
