Author Topic: VBS:Gamaredon-CM [Apt] multiple detections, are this FP or real detections?  (Read 2315 times)

0 Members and 1 Guest are viewing this topic.

Offline Dimitri

  • Newbie
  • *
  • Posts: 1
Dear Avast

Today after updating Avast Premium Security to the latest version 22.2.6003 (v 22.2.7013.717) with virus definitions 220322-4, I got some detections which were automatically put in the Quarantine.

These are all detections of the kind "Gamaredon-CM [Apt]" in the following folders/files.
  • C:\Users\%USERNAME%\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\...\(Multiple_random_named_files...).js
  • C:\Users\%USERNAME%\AppData\Roaming\Hard Disk Sentinel\hds_control_check.vbs
  • C:\Program Files\Microsoft OneDrive\22.033.0213.0002\Animation.html

I also reported these detections for further analysis through the Avast software.

I already read the following post on Twitter => https://twitter.com/Spitlebug/status/1506328113336135680 as well as multiple topics on this forum regarding the "Prefs.js" file for Firefox and Thunderbird where some people mention this is a FP.

It is almost unimaginable that these (or similar) detections are not happening to a lot more customers.

Can someone of the Avast dev team please look into this and confirm wether these are FP and thus safe to remove from the Quarantine?

At this moment I don't feel safe removing them from the Quarantine even though my gut feeling is telling me these are FP.

A full complete system scan did not show any other threats.  :)

Thanks you in advance!
Kind regards

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37527
  • Not a avast user

Offline JakubV

  • Threat Operations
  • Avast team
  • Newbie
  • *
  • Posts: 12
Hi Dimitri,

This was indeed an FP, it is safe to restore the files from quarantine.

Apologies for the hassle, hope you have a nice day.

Jakub