exploit in Emsisoft notification

[cma6 3]

I was reading the recent EIS notification re Double Pulsar malware and while reading it online with Chrome, there was an attempt at an exploit in the folder \Downloads\Emsi\

but fortunately EIS stopped the exploit.

 

[GT500 501]

What does the Behavior Blocker log say about it? You can view the log by opening EIS, clicking on Logs, and selecting Behavior Blocker in the menu at the top. There's also an Export in the lower left corner if you'd like to save the log somewhere (it will open automatically in Notepad when you save it) if you'd like to copy the link showing the exploit attempt into a reply.

[cma6 3]

Behavior Blocker log has no entry after 6/30/17, perhaps because the exploit was stopped by EIS. BTW, I noticed at the time of the EIS notification of exploit blocked that at that instant, EIS was "installing", which I cancelled. I then rebooted and did a Custom Scan.

[GT500 501]

The DoublePulsar exploit detection only detects if DoublePulsar is trying to install a payload, so it is possible that there is still a DoublePulsar infection present and it just hasn't tried installing another payload since the first time it was blocked. That being said, our DoublePulsar detection is fairly new and I'm not sure whether or not it is possible for something to trigger a DoublePulsar alert even if it isn't actually DoublePulsar (most Behavior Blocker alerts can be triggered by legitimate software). Just in case I recommend following these instructions for creating a new topic in our Help, my PC is infected! section, and one of our malware removal specialists will take a look at your logs.