csalmon

Thanks, unfortunately he had already run it. Since there is definitely something fishy with the file and no virus scanners seem able to identify it as a threat, I think at this point it is probably best to just reinstall windows to a new drive and start over. Thanks again nasdaq!

Nasdaq, my friend just let me know that since the file I uploaded to virustotal was in the form of filename.avi.lnk with the target being powershell, it only scanned the powershell command on my PC. He opened the file in a hex editor and stripped out the extra padding and rechecked it on virustotal. This is a very different result on the actual file. What are your thoughts on this? https://www.virustotal.com/#/file/bb745ee7b0bd0dd70ab075a068e18e5ad38b30f0a3758c7e9efffd00b7c5658c/detection

I don't think so. Thanks so much for giving me peace of mind with this issue and that suspicious file!

Here is the link to the scan. https://www.virustotal.com/#/file/d3f8fade829d2b7bd596c4504a6dae5c034e789b6a3defbe013bda7d14466677/detection

Here is the Sophos log from a few days ago when I ran it. SophosVirusRemovalTool.log

Thank you Nasdaq, I will run the Sophos check tonight and post the results. Is there some way to upload this file to you for analysis? The file is large (1.5 GB)and is definitely meant to contain malware of some sort.

MBAM logfile attached. The file in question was shortcut file that was disguised as a .avi movie file. The target in the file was executing an elevated powershell command. I know these logs don't seem to show any infections but I am very suspicious of this file. I am nervous that malware scanners are not identifying this file correctly. Unfortunately the file is 1.5GB so it too big to upload anywhere to check. Malwarebytes Summary File.txt

Thank you nasdaq, I have attached the shortcut file for reference. Can you let me know how to create the MBAM log? Chuck Shortcut.txt

My roommate ran a shortcut he downloaded and it appears to have installed some kind of malware. Malewarebytes is giving me this error now. Please help. Log files are attached. FRST.txt Addition.txt