Trojan.Crypt & Spyware.PasswordStealer & Spyware.AgentTesla

[AlexLeadingEdge]

Are these false positives? Three detection types for the same program. I believe Native Images is a Microsoft .NET program.

 

2022-01-02 09:43:58 AM    Trojan.Crypt    REDACTED    Malware    file    C:\Windows.old\WINDOWS\assembly\NativeImages_v4.0.30319_32\FSharp.Lang8152be21#\40b5a56f150011d0c51fa11bfbc6e1ee\FSharp.LanguageService.Base.ni.dll

2022-01-02 09:43:58 AM    Spyware.PasswordStealer    REDACTED    Malware    file    C:\Windows.old\WINDOWS\assembly\NativeImages_v4.0.30319_32\NuGet.Commands\f154ae2115190e7d3d955cd4b7ca51ff\NuGet.Commands.ni.dll

2022-01-02 09:43:58 AM    Spyware.PasswordStealer    REDACTED    Malware    file   C:\Windows.old\WINDOWS\assembly\NativeImages_v4.0.30319_32\FSharp.Projc0b0e1ec#\41ac35f187be0c6809aab3fce1e98c13\FSharp.ProjectSystem.PropertyPages.ni.dll

2022-01-02 09:43:58 AM    Trojan.Crypt    REDACTED    Malware    file C:\Windows.old\WINDOWS\assembly\NativeImages_v4.0.30319_32\Microsoft.V159eb141#\68e338c8fd741854bf0c872f0349b630\Microsoft.VisualStudio.TestWindow.Host.ni.dll

2022-01-02 09:43:58 AM    Spyware.AgentTesla    REDACTED    Malware    file    C:\Windows.old\WINDOWS\assembly\NativeImages_v4.0.30319_32\fsc\c7885f835f4d68bc4a8f20a3da0d4a54\fsc.ni.exe

Edited January 11, 2022 by AlexLeadingEdge

[cli]

Can you attach logs and detected files? Thanks.

[AlexLeadingEdge]

Is there a way to provide the (potentially infected) detected files without restoring them to the end user's machine? If it is actually a trojan I don't really want to be doing that...

Logs are attached.

364786596_MalwarebytesDiagnostics.zip

[cli]

I've found all the information I need in the logs and no longer require the detected files. This will be fixed in the next update. Thanks for reporting.