Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 935002" data-attributes="member: 32260">Final determination - not malware:[ATTACH=full]255660[/ATTACH]I followed the instructions to remove dynamic signatures and update:[ATTACH=full]255661[/ATTACH]Finally, run the script. This time it was allowed to run (no TrojanDownloader:HTML/Adodb.gen!A detection). Unfortunately, after downloading the photo, the script has been blocked by Defender, although Defender did not show the alert this time. The below alert is from Windows Script Host:[ATTACH=full]255662[/ATTACH]Translation from Polish: &quot;This script contains malicious content and has been blocked by the antivirus program&quot;. I checked the detection: Trojan:VBS/Mountsi.A!mlI will test it tomorrow because the update of AMSI-paired ML signatures/rules can be updated by Microsoft later.</blockquote>

[QUOTE="Andy Ful, post: 935002, member: 32260"] Final determination - not malware: [ATTACH type="full" alt="1615977033399.png"]255660[/ATTACH] I followed the instructions to remove dynamic signatures and update: [ATTACH type="full" alt="1615978694349.png"]255661[/ATTACH] Finally, run the script. This time it was allowed to run (no [B]TrojanDownloader:HTML/Adodb.gen!A [/B]detection). Unfortunately, after downloading the photo, the script has been blocked by Defender, although Defender did not show the alert this time. The below alert is from Windows Script Host: [ATTACH type="full" alt="1615978944056.png"]255662[/ATTACH] Translation from Polish: "This script contains malicious content and has been blocked by the antivirus program". I checked the detection: Trojan:VBS/Mountsi.A!ml I will test it tomorrow because the update of AMSI-paired ML signatures/rules can be updated by Microsoft later. [/QUOTE]

Verification