LiorBanai 0 Posted January 26, 2021 Share Posted January 26, 2021 Hi I have my own exe and Eset keep deleting it! so I know it is not a trojan. How come you don't know how to scan files? Link to comment Share on other sites More sharing options...
Administrators Marcos 5,073 Posted January 26, 2021 Administrators Share Posted January 26, 2021 I assume it was FP. Restore the files from quarantine and re-scan. Link to comment Share on other sites More sharing options...
Didarul Mawla 0 Posted January 26, 2021 Share Posted January 26, 2021 I am running ASP.NET Core 5. A while ago I was building my web application and threat alert pops up saying Win64/Patched.U trojan attacked MSBuild.Exe and I am stuck with my project. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,073 Posted January 26, 2021 Administrators Share Posted January 26, 2021 16 minutes ago, Didarul Mawla said: I am running ASP.NET Core 5. A while ago I was building my web application and threat alert pops up saying Win64/Patched.U trojan attacked MSBuild.Exe and I am stuck with my project. Please see my reply above. Link to comment Share on other sites More sharing options...
itman 1,659 Posted January 26, 2021 Share Posted January 26, 2021 MSBuild.exe can be used maliciously: https://attack.mitre.org/techniques/T1127/001/ . If you are deploying PlugX within the app, this might be what is triggering the Eset detection. Link to comment Share on other sites More sharing options...
LIor Banai 0 Posted January 26, 2021 Share Posted January 26, 2021 (edited) 2 hours ago, Marcos said: I assume it was FP. Restore the files from quarantine and re-scan. What is FP? and the file was deleted. Restore need password which I do not have. it seems you release defective signature package! Edited January 26, 2021 by LIor Banai add more info Link to comment Share on other sites More sharing options...
Administrators Marcos 5,073 Posted January 26, 2021 Administrators Share Posted January 26, 2021 FP stands for false positive. You should be able to find the detected files in quarantine and restore them. Link to comment Share on other sites More sharing options...
Most Valued Members peteyt 393 Posted January 26, 2021 Most Valued Members Share Posted January 26, 2021 1 hour ago, LIor Banai said: What is FP? and the file was deleted. Restore need password which I do not have. it seems you release defective signature package! I presume this is something not released or digitally signed? Could be why eset picked it up Link to comment Share on other sites More sharing options...
itman 1,659 Posted January 26, 2021 Share Posted January 26, 2021 2 hours ago, LIor Banai said: Restore need password which I do not have. Restoring a file from Eset Quarantine does not require a password. Are you stating that Eset GUI settings are password protected? Ref.: https://support.eset.com/en/kb3195-restore-a-quarantined-file-in-eset-windows-home-products Link to comment Share on other sites More sharing options...
Recommended Posts