Trojan.LNK.Gen is a generic detection for maliciously modified shortcut files (file extension .LNK) that are designed to trick users into launching a harmful file.
Security programs use generic detections that look for broad patterns of code or behavior to identify similar programs or files. If you suspect the file was incorrectly detected, go to: Removal: Suspect a file is incorrectly detected (a False Positive)?.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
LNK files are shortcut files that display an icon on the computer Desktop or in a folder, and act as a direct link to a specified folder, file or system location. Shortcuts are used to make finding specific files or system locations much more convenient for the user.
Attackers however can modify shortcut files, or drop specially-crafted ones, that point to harmful files or components that have been silently installed on the system. When the user clicks on the 'booby-trapped' shortcut, they unintentionally launch the harmful file.
Harmful LNK files will usually mimic legitimate ones by using the file icons associated with popular programs such as Notepad, Word, PDF, etc to trick the user into thinking that the shortcuts are authentic.
Some malware will install harmful LNK files as part of their payload.
Harmful LNK files are also often spread in infected removable drives; in such cases, the harmful files they link to are hidden on the removable drive, while the LNK file is visible.
Based on the specific malware, clicking the shortcut can result in various actions. Some malware show no obvious actions after the shortcut is clicked, but will silently run malicious components in the background. Other will open a legitimate program (for example Word or Notepad) to distract the user, while still silently launching other components in the background.
Some LNK malware will also open the command prompt (cmd.exe) and execute malicious scripts in the background, so that several different malicious routines can run at the same time. Examples of such scripts include:
The Trojan.LNK.Gen generic detection can also be triggered by LNK components used by malware families, particularly those that are written in the AutoIT or VBS languages, such as:
This detection will also identify malware executed from a shell and in some cases, will identify malware that contain specific parameters or instructions.