Unusual appeareances of Desktop Lock and Virtual Screen icons

%3CLINGO-SUB%20id%3D%22lingo-sub-2018142%22%20slang%3D%22en-US%22%3EUnusual%20appeareances%20of%20Desktop%20Lock%20and%20Virtual%20Screen%20icons%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2018142%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20administrating%20a%20Win%20server%202016%26nbsp%3B%20running%20for%26nbsp%3B%207%20month%20now.%26nbsp%3B%20Recently%2C%20in%20the%20last%2010%20days%20or%20so%2C%20a%20number%20of%20icons%20and%20folders%20are%20appearing%20on%20my%20Administrator%20desktop.%20They%20are%20also%20appearign%20on%20users%20desktops.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOur%20users%20claimed%20not%20to%20have%20any%20part%20in%20installing%20these%20apps.%26nbsp%3B%20I%20have%20no%20way%20to%20validate%20if%20this%20is%20true%20or%20not.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20a%20virtual%20server%20and%20all%20access%20is%20u%20sing%20RDS%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPleases%2C%20may%20anyone%20here%20recognize%20this%20icons%20and%20feedback%3F%26nbsp%3B%20I%20am%20looking%20online%20but%20can%20not%20find%20anything%20about%20them.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Screenshot_1.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F243069iB6579BD7920765BC%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Screenshot_1.jpg%22%20alt%3D%22Screenshot_1.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2018142%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
New Contributor

I am administrating a Win server 2016  running for  7 month now.  Recently, in the last 10 days or so, a number of icons and folders are appearing on my Administrator desktop. They are also appearign on users desktops.

 

Our users claimed not to have any part in installing these apps.  I have no way to validate if this is true or not. 

 

This is a virtual server and all access is u sing RDS

 

Pleases, may anyone here recognize this icons and feedback?  I am looking online but can not find anything about them.

 

Screenshot_1.jpg

 

 

 

 

 

 

1 Reply

Hello @jecalderon 

 

Have you check for any certificates for the files following the shortcut properties. You could also check gather the file hashes and do a search for any know malware.