Trojan.BitCoinMiner - autochk.exe detection ?

[ainyc]

Got an alert after 2 servers rebooted after installing April Microsoft Updates, Trojan.BitCoinMiner, C:\Windows\System32\autochk.exe

This looks like a false positive... ? Anyone else getting this? Is it safe to restore it?

[jacoa]

I got the same result. I suspect it's a false positive, too.

[Angus_MacGyver]

even during a scan a few hours ago I found this malware !!!
ps. Immediately after updating the program I did a scan

what does it mean? do I have to worry? I performed the deletion now if I do another scan it does not detect it anymore

 

[Kalrand]

I also saw this when I came to work this morning as well, only on one workstation.

[Kalrand]

I did a test. I scanned my autochk.exe and it was clean. Copied it to a USB stick and ran a scan from the workstation on that file, it came up clean. Moved the file back to C:\Windows\System32 and ran another scan, it also came up clean. Unfortunately this doesn't point either way if it's a false positive or not. 

[Kalrand]

Looks like it is a false positive.

 

[shadowwar]

this is resolved in:

MBAM2 Version: v2018.04.11.07

MBAM3 Version: 1.0.4698

[Angus_MacGyver]

I deleted the file in question. now when I start it gives me the error file not found the system !!! How can I download and restore? Autochk.exe

 

Edited April 11, 2018 by Angus_MacGyver

[shadowwar]

The file is attached to this first post.

 

[Angus_MacGyver]

Thanks a lot for the answer. but how do I restore?

 

[djacobson]

1 hour ago, Angus_MacGyver said:

Thanks a lot for the answer. but how do I restore?

 

Which product version do you have? Another thing to consider is if the item is marked as delete on reboot, that reboot needs to happen first before the item can be restored from either product versions menus.

[djacobson]

Hey guys, here's a link to a Box folder with an autochk from a variety of Window's OS - https://malwarebytes.box.com/s/38029s7dk27lb7ksiszkrbqlh83kxonr

[shadowwar]

This only hit on one file though. win10 insider preview version.

Edited April 13, 2018 by shadowwar

[djacobson]

2 hours ago, shadowwar said:

This only hit on one file though. win10 insider preview version.

Whoops! Went too hard.