File names such as 1.lock and 2.lock appeared in the MAYUNDO scenarios studied by ANTÍDOTO. That does not make every file bearing such a name malicious.
Why the names are insufficient
Extensions and names can occur in unrelated applications. Location, origin, timing relative to other artifacts and execution behavior should be considered to avoid premature conclusions.
What to look for together
Unexpected USB shortcuts, scripts associated with Windows Script Host, persistence and hidden folders can strengthen suspicion of an infection chain. Finding one isolated file is not enough.
What to do with the file
Avoid executing, renaming or deleting it without understanding its purpose. Record the path, examine the context and postpone remediation until compatible indicators are confirmed.
Lesson from V1.6.3
One ANTÍDOTO design principle is not to classify threats based on names alone. MAYUNDO tests validated specific chains, not universal rules about file names.
Related reading
- How to recognize MAYUNDO indicators without misdiagnosing
- MAYUNDO and false positives: why a suspicious filename is not enough
A safer scan with ANTÍDOTO
If you recognize these symptoms, you can download ANTÍDOTO and run a free scan of Windows and external devices. Review the findings before deciding on remediation, which requires a license. See the licensing plans and Resource Center. Detections and outcomes depend on the individual case.