Kaspersky detected trojan win 32 generic. Should I full format my pc?

gfgtkitkat34

Level 1
Thread author
Aug 14, 2024
30
Kaspersky detected this UDS Trojan Win 32 generic on my PC, and I followed all the instructions and hopefully removed it from my PC, according to Kaspersky. So am I safe now, or should I just clean install Windows again with a USB and start things from scratch?

Now this particular trojan is not an executable file; it came bundled with a 3D hair asset archive (Robin hair). You don't have to install it; you just extract it, copy it, and paste it in your 3D software's assets library.

Is it okay to keep using this PC for rendering tasks because I didn't execute anything?

I use this PC only for rendering and gaming and don't use it for anything important like bank transactions, but still, I like to have peace of mind when I'm working.

I'd be grateful for any helpful advice.
 

Attachments

  • Screenshot (8).png
    Screenshot (8).png
    2.9 MB · Views: 124

Bot

AI-powered Bot
Apr 21, 2016
4,215
If Kaspersky has successfully removed the trojan, your PC should be safe. However, it's always a good idea to do a full scan again to ensure no remnants of the trojan are left. If you're still concerned, a clean install of Windows can provide peace of mind. As for your 3D software, ensure you're downloading assets from trusted sources to prevent future infections.
 

gfgtkitkat34

Level 1
Thread author
Aug 14, 2024
30
If Kaspersky has successfully removed the trojan, your PC should be safe. However, it's always a good idea to do a full scan again to ensure no remnants of the trojan are left. If you're still concerned, a clean install of Windows can provide peace of mind. As for your 3D software, ensure you're downloading assets from trusted sources to prevent future infe

I see there were some files inside a zip file... check K. Quarantine.
Everything are deleted and disinfected after advanced disinfection restart.
 

Attachments

  • Screenshot (9).png
    Screenshot (9).png
    887.3 KB · Views: 117
  • Screenshot (10).png
    Screenshot (10).png
    887.4 KB · Views: 119

Bot

AI-powered Bot
Apr 21, 2016
4,215
If the suspicious files are in Kaspersky's quarantine, they are isolated and can't harm your PC. You can safely delete them from quarantine. If you're still concerned, a clean install of Windows can provide additional assurance. Always ensure to download assets from trusted sources.
 

Brahman

Level 18
Verified
Top Poster
Well-known
Aug 22, 2013
872
Norton power eraser and Emsisoft emergency kit came up clean. I guess there's no need for clean windows install then. I hope!??..
If it's the main system you use for banking or other money transactions, just don't take a risk. You may need to spend a 3 or 4 hours to reinstall but it will give you complete peace of mind. This time do keep a clean base system image so that you can go back to it in the event of a mishap.
 

cartaphilus

Level 10
Verified
Well-known
Mar 17, 2023
491
Kaspersky detected this UDS Trojan Win 32 generic on my PC, and I followed all the instructions and hopefully removed it from my PC, according to Kaspersky. So am I safe now, or should I just clean install Windows again with a USB and start things from scratch?

Now this particular trojan is not an executable file; it came bundled with a 3D hair asset archive (Robin hair). You don't have to install it; you just extract it, copy it, and paste it in your 3D software's assets library.

Is it okay to keep using this PC for rendering tasks because I didn't execute anything?

I use this PC only for rendering and gaming and don't use it for anything important like bank transactions, but still, I like to have peace of mind when I'm working.

I'd be grateful for any helpful advice.
If positively, definitely needs to be clean then it's batter to Nuke and Pave. Then reinstall everything and invest in a daily or weekly backup solution that backs up the files to an external drive. That way if you ever come across this issue again, all you will lose is a day or week worth of data.
 

gfgtkitkat34

Level 1
Thread author
Aug 14, 2024
30
If positively, definitely needs to be clean then it's batter to Nuke and Pave. Then reinstall everything and invest in a daily or weekly backup solution that backs up the files to an external drive. That way if you ever come across this issue again, all you will lose is a day or week worth of data.
Kaspersky did its job and detected it, but still, I'm with you guys; full nuke will be the safest option. There's no hurry, though. I don't have anything valuable on this system. just 100 GB or so of Daz3D rendering assets from render state. I will format it with a clean USB in a few days.
 

gfgtkitkat34

Level 1
Thread author
Aug 14, 2024
30
If positively, definitely needs to be clean then it's batter to Nuke and Pave. Then reinstall everything and invest in a daily or weekly backup solution that backs up the files to an external drive. That way if you ever come across this issue again, all you will lose is a day or week worth of data.
one more thing. So I need to get myself a Windows 10 bootable USB from a clean computer, then insert it while the PC is turned off, then boot up the PC and go directly into the BIOS menu without logging into my account. Boot Windows 10 from USB and full format all partitions and delete them, and finally install Windows 10.

Are the steps correct, or am I missing on something?

Thank you.
 

gfgtkitkat34

Level 1
Thread author
Aug 14, 2024
30
This is why we run KES in default deny. We must forensically vet any software introduced. Even as far as checking vendor due diligence. Intake for all vendors and analysis of their so called products
I'm sorry, but you didn't read the post, my friend. This particular trojan is not an executable file; it came bundled with a 3D hair asset archive. There's nothing to install on it; you just extract it to your 3D software's assets library." Kaspersky instant file scan detected it when I scanned the archive manually. system watcher wasn't triggered because it was not a real-time execution.
 
Last edited:

gfgtkitkat34

Level 1
Thread author
Aug 14, 2024
30
If a full scan with Kaspersky, NPE and EEK didn't find any problem then you are safe, you don't need to do anything more.
Yes, that's exactly what I thought earlier. Since I didn't install anything, and it wasn't an execution whatsoever, I'm assuming you're correct. it was just a malware file inside an archive that I manually discovered with instant scan.

Appreciate your feedback as always.
 
  • +Reputation
Reactions: lokamoka820

gfgtkitkat34

Level 1
Thread author
Aug 14, 2024
30
This seems to be the zip


And the “problem”


And on OpenTip

Yes, that's the culprit. Kaspersky disinfected and deleted it, so I'm assuming everything is okay. By the way, it was nice of you to take your time to analyze it and share your research with us. People rarely go that far.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top