Random Icons

[yuzu]

16 random icons appeared and i cannot seem to be able to delete them. Right clicking them brings up 3 options: cut, make shortcut, and delete. Anyone have any idea what they may be? I already did a scan with defender and malwarebytes and nothing unusual came back in the rerport.

 

[ChatGPT]

Looks like those are broken/stray desktop shortcuts that reference shell CLSIDs (the magnifying‑glass icon and names like "CLSID_Start..." / "GUSID_Start..." in your photo). They’re usually just .lnk files on the Desktop and can be removed — either something created them or the shortcuts became corrupted. Tell me which Windows version you have (run winver) and whether they reappear after you restart; meanwhile try the steps below.
Quick checks (easy)

1. Open File Explorer and go to your user Desktop:
   • Paste %userprofile%\Desktop into the address bar and press Enter.
   • Do you see those same icons listed there? Can you delete them from this folder (select → Del)?
2. Also check the public Desktop:
   • Paste C:\Users\Public\Desktop into the address bar and look for them there.

If they delete normally from File Explorer, reboot and see if they come back. If they reappear, something is recreating them (see steps below).
If you cannot delete them (or want a safer command-line approach)
A. List the desktop files (to confirm names)

• Open Command Prompt (press Start, type cmd, press Enter) and run:
  dir "%userprofile%\Desktop" /a
  dir "C:\Users\Public\Desktop" /a

B. Try deleting one that matches the strange name (example):

• In an elevated Command Prompt (right‑click cmd → Run as administrator):
  del "%userprofile%\Desktop\CLSID_Start.lnk" /f
  (replace the filename with the exact name shown by the dir command)

If deletion fails with a permission error, take ownership and grant yourself permissions, then delete:

• takeown /f "%userprofile%\Desktop\<filename>"
• icacls "%userprofile%\Desktop\<filename>" /grant "%username%":F
• del "%userprofile%\Desktop\<filename>" /f

Safer PowerShell way (lists first, then remove)

• Open PowerShell (as admin) and run to preview:
  Get-ChildItem -Path $env:USERPROFILE\Desktop,"C:\Users\Public\Desktop" -File | Where-Object Name -Match "CLSID|GUSID|GUID|Start" | Select FullName
• If the list matches what you want removed, run:
  Get-ChildItem -Path $env:USERPROFILE\Desktop,"C:\Users\Public\Desktop" -File | Where-Object Name -Match "CLSID|GUSID|GUID|Start" | Remove-Item -Force

If they come back after deletion

1. Check Startup / Task Scheduler / Autoruns for a program recreating them:
   • Open Task Manager → Startup tab and disable any suspicious program.
   • Download and run Autoruns (Sysinternals) to look for anything creating Desktop shortcuts (search for references to "Desktop" or the shortcut names).
   • Open Task Scheduler and check for any recently added tasks that run at login.
2. Scan for persistence mechanisms:
   • You already scanned with Defender & Malwarebytes; that’s good. If icons recreate, run Autoruns and inspect the entries under Logon, Scheduled Tasks, and Explorer sections.

Other helpful checks

• Right‑click one of the icon(s) → Properties and tell me the Type of file, Target (if shown), and Location. If Properties doesn’t show as a .lnk, tell me what it shows.
• Tell me whether they appear for every user account on the PC (create another Windows user quickly and check).
• Tell me if they appeared after installing/updating something (new apps, themes, Rainmeter, Wallpaper Engine, some third‑party tweaker).

If you prefer, I can walk you through the exact commands step‑by‑step. Tell me:

• The output of the dir commands above (or paste the file names), and
• Your Windows version (run winver and paste the result).