One challenge in computer security is telling malicious software apart from ordinary components with similar names. Deleting everything that looks unusual can create another problem: lost files or broken legitimate programs.
Names that raise questions
start.js, profile.js, wscript.exe, cscript.exe and 1.lock may appear in investigations, but none is a universal MAYUNDO signature.
The role of behavior
The relationship between unauthorized shortcuts, invoked scripts, persistence and hidden files provides more context. Diagnosis should consider the chain rather than a keyword list.
How to reduce errors
Do not execute unknown samples, preserve file paths and origins, document scanner results and avoid irreversible manual remediation without enough evidence.
ANTÍDOTO design principle
ANTÍDOTO V1.6.3 correlates indicators before increasing severity and taking action. This does not eliminate the possibility of false positives, but aims to reduce decisions based on names alone.
Related reading
- start.js and profile.js: when these files may be part of MAYUNDO
- MAYUNDO V1.6.3 tests: what was and was not proven
A safer scan with ANTÍDOTO
If you recognize these symptoms, you can download ANTÍDOTO and run a free scan of Windows and external devices. Review the findings before deciding on remediation, which requires a license. See the licensing plans and Resource Center. Detections and outcomes depend on the individual case.