Author Topic: Powershell - Fileless Malware (Read 3065 times)

REDACTED · « **on:** February 14, 2018, 12:41:34 PM »

Several times a day I'm getting the following notice:

We've moved the threat powershell.exe to your virus chest

Looking at details I get:

Threat Name: IDP.HELU>PSE13 - Fileless malware
Process: [drive letter]\System32\WindowsPowerShell\V1.0\powershell.exe
Detected by: Behavior Shield
Status: Move to Virus Chest

Look in the Virus Chest and there's no files in there.

This has been going on for a couple weeks now and I've run many antivirus, malware, and PUP checkers above and beyond Avast... and nothing, not a single one of them, finds a thing.

So... help please... this is driving me nuts.

Asyn · « **Reply #1 on:** February 14, 2018, 12:44:12 PM »

Attach your basic diagnostic logs. (MBAM and FRST)
Instructions: https://forum.avast.com/index.php?topic=194892

Michael (alan1998) · « **Reply #2 on:** February 14, 2018, 02:31:32 PM »

Can you upload the file to www.virustotal.com too? (and post the scan result here please.)

Author Topic: Powershell - Fileless Malware (Read 3065 times)

REDACTED

Powershell - Fileless Malware

Asyn

Re: Powershell - Fileless Malware

Michael (alan1998)

Re: Powershell - Fileless Malware