APPDATA folder

[cengiz]

Hello there,
I downloaded malware on my computer. I opened the file by double clicking it. Emsisoft caught the trojan. I ran a malware scan in the AppData folder on my computer. And I caught the same trojan in AppData folder. How did the trojan caught by Emsisoft infect the AppData folder. Should I be worried about this? Or should I think it's okay as the trojan in this folder doesn't display any malicious behavior. I have used other antiviruses and they were catching and quarantining them even if the AppData folder was infected.

[ShadowPuterDude]

Hello @cengiz,

 

Welcome to the Emsisoft Support Forums.
 

The detection was against the file being executed.  Often malware will unpack itself and a copy will be stored in another folder on the system.  In order to get a clearly pictures of the actual events, I would like to get a copy of the forensics log.

 

Please export and send the Emsisoft program forensic logs:

 

1. Open the Emsisoft program, then click the blue Logs tile.
2. Make sure "All components" is selected in the "View" pulldown, and that every checkbox in the "Components" section when you click the pulldown is filled.
3. Click the Export button in the lower left corner.
4. Choose where to save the exported file, so you can find it for emailing. I would suggest your desktop.
5. Attach the exported log to a reply to this email.

[cengiz]

I downloaded it from the websites that distribute malware on avlab.pl.  This has also happened to me before with malware that I downloaded from different websites.  When malware copies itself to other folders, Emsisoft needs to automatically detect and quarantine it.  Otherwise, the inside of the computer will be like a zoo of malware.
 

[ShadowPuterDude]

@cengiz

Frankly I have no idea what happened without a forensics log and the actual malware.  Posting and telingl us that we have to do better.  Without providing logs and the actually malware sample does not help us figure out why the file was missed and fix the issue.

[ShadowPuterDude]

Send the malware sample to [email protected] with a detailed explanation.