47 detections, Riskware.Injector.Generic I quarantined and deleted.

[starrynight]

Never have I ever gotten so many detections then as of today, only to find out later by checking this forum that they are fp's, unfortunately because I jumped the gun and quarantined then deleted out of fear, what does this mean for my computer? Did I just  accidentally delete legit microsoft files?, if so what do I do now? I had to create an account here just to post this because this has never happen.

[TwinHeadedEagle]

@starrynight This was a False Positive detection. You can restore all entries from quarantine titled as Riskware.Injector.Generic, it only detected Scheduled Tasks.

[starrynight]

there are no entries to restore as I deleted them from quarantine, I didn't think to hold onto them as I thought they were bad, How was I suppose to know they were safe, I panicked, I only realized later after checking my second computer that it detected the same fp's so that's why I came to this forum. How do i repair the unintentional damage from these fp's?

[ritterbruder]

I'd start with an elevated command prompt and try an sfc /scannow to see if it replaces any critical system files.

[shadowwar]

Quarantine should never be deleted immediatly. Best to keep it for a few days at least so if its a fp it can be restored. Anything in quarantine is encrypted and cant possibly run anymore. 

 

We would need to see the scan log showing the detections so see what damage may need to be repaired if any. 

 

Edited May 19, 2021 by shadowwar

[TwinHeadedEagle]

You can try system restore but it wasn't very reliable from my experience, I might be wrong.

Recovery options in Windows 10 (microsoft.com)

[Nomad]

18 minutes ago, shadowwar said:

Quarantine should never be deleted immediatly. Best to keep it for a few days at least so if its a fp it can be restored. Anything in quarantine is encrypted and cant possibly run anymore. 

 

We would need to see the scan log showing the detections so see what damage may need to be repaired if any. 

 

Like @starrynight  I got the same 47 detections.  Then quarantined and deleted.    I do have  a report and mbst-grab-results which are attached.   Is this what you need to assess if anything critical is deleted?

Thanks for the help,

Jim (Nomad)

ASUSPRO Report 1 May 19 2021.txt ASUSPRO Report 2 May 19 2021.txt mbst-grab-results.zip

[TwinHeadedEagle]

@Nomad

You can restore from quarantine everything related to Riskware.Injector.Generic

[Nomad]

8 minutes ago, TwinHeadedEagle said:

@Nomad

You can restore from quarantine everything related to Riskware.Injector.Generic

Thanks @TwinHeadedEagle.  I have done so and updated to most recent package version. 1.0.46050.   However, based on the reports I uploaded can you tell if any of the files deleted (in ignorance on my part) are critical? 

 

[TwinHeadedEagle]

@Nomad They are not critical and won't affect or crash Windows.

[Nomad]

@TwinHeadedEagle Thanks for that. And I have learned the lesson of only quarantining suspicious files until further analysis is done. 

[TwinHeadedEagle]

You can always quarantine but never empty the quarantine immediately as malware is inactive inside it.

[TwinHeadedEagle]

Above in case it needs to be restored.