Advice Request Did Avast One really quarantine PowerShell.exe?

[MacDefender]

https://malwaretips.com/threads/agenttesla-trojan-downloader-04-03-2022.112664/post-977747

@Andrew3000 i was looking at the dynamic result there and the dialog made it sound like it moved the PowerShell interpreter to Quarantine

Did it actually end up doing that? I’m guessing Windows system file self-heal would’ve restored PowerShell.exe, but most behavior blockers seem to understand just killing the process is sufficient and you don’t need to delete a legitimate Windows binary.

 

[Andrew3000]

No, it is Avast that shows the different path to the malware that was originally launched. The first time I noticed this thing it scared me, evidently Avast likes jokes!
If you restore from quarantine, the file is restored is the correct one (.vbs)
See the screenshots in the spoiler

Spoiler

 

[peter1111]

"evidently Avast likes jokes!" and they made their product a joke

 

[MacDefender]

No, it is Avast that shows the different path to the malware that was originally launched. The first time I noticed this thing it scared me, evidently Avast likes jokes!
If you restore from quarantine, the file is restored is the correct one (.vbs)
See the screenshots in the spoiler

Spoiler

View attachment 264778
View attachment 264779

Ah great! Too funny, if I saw that dialog I would have had a heart attack.