Don_yourWhiteHat
-
Content Count
3 -
Joined
-
Last visited
-
Trojan.Agent.Trace DelUS.bat
Don_yourWhiteHat replied to Don_yourWhiteHat's topic in File Detections
is there any way to know what it was a trace of? -
Got a detection this morning on ONE computer but the file doesn't seem to be malicious. Please explain how this batch file is a Trojan: Trojan.Agent.Trace Quarantined C:\DelUS.bat Contents: :Repeat attrib -R "C:\Users\MICHAE~1.BRI\AppData\Local\Temp\DelE864.tmp" del "C:\Users\MICHAE~1.BRI\AppData\Local\Temp\DelE864.tmp" if exist "C:\Users\MICHAE~1.BRI\AppData\Local\Temp\DelE864.tmp" goto Repeat attrib -R "\DelUS.bat" del "\DelUS.bat"
-
Similar situation with Visual Studio but more detections: 10/19/2018 11:00:44 PM xxxxxxxxxxxxx xxxxxxxxxxxxx Adware.Agent Quarantined C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\Packages\fpeditax.dll 10/19/2018 11:00:44 PM xxxxxxxxxxxxx xxxxxxxxxxxxx Adware.Agent Quarantined C:\ProgramData\Package Cache\{6CFDA13E-A348-315B-820A-603BBCBD7684}v14.0.23107\packages\vs_isoshellcore\cab4.cab 10/19/2018 11:00:44 PM xxxxxxxxxxxxx xxxxxxxxxxxxx Adware.Agent Quarantined C:\ProgramData\Package Cache\{DE064F60-6522-3310-9665-B5E3E78B3638}v14.0.23107\packages\communitycore\Setup\cab6.cab 10/19/2018 11:00:44 PM xxxxxxxxxxxxx xxxxxxxxxxxxx Adware.Agent Quarantined C:\Windows\Installer\$PatchCache$\Managed\06F460ED2256013369565B3E7EB86383\14.0.23107\VWD_fpeditax_dll_x86 10/19/2018 11:00:44 PM xxxxxxxxxxxxx xxxxxxxxxxxxx Adware.Agent Quarantined C:\Windows\Installer\$PatchCache$\Managed\E31ADFC6843AB51328A006B3CBDB6748\14.0.23107\VWD_fpeditax_dll_x86