ANTÍDOTO V1.6.3 introduces behavioral analysis focused on patterns associated with MAYUNDO and USB/LNK worms. Its aim is not to delete files merely because their names look suspicious, but to establish the context in which they appear.
What the engine correlates
A suspicious chain may involve .lnk shortcuts, start.js, profile.js, Windows Script Host execution, Windows startup persistence, and legitimate documents moved into hidden directories. No single indicator, by itself, confirms malware.
Results of V1.6.3 testing
In the MAYUNDO scenarios reproduced and validated in the lab, ANTÍDOTO identified the observed chain, remediated associated malicious components, removed Windows persistence, recovered legitimate documents and completed rescans without the known indicators for those scenarios.
Important limitations
This evidence does not mean all current or future variants are covered. A real-world infection may use additional mechanisms, so both Windows and external devices should be examined and personal files should be preserved throughout remediation.
A safe next step
If you notice unexpected shortcuts, missing files or signs of reinfection, do not launch the shortcuts. Scan first and review the report before authorizing a corrective action.
Related reading
- How to recognize MAYUNDO indicators without misdiagnosing
- MAYUNDO V1.6.3 tests: what was and was not proven
A safer scan with ANTÍDOTO
If you recognize these symptoms, you can download ANTÍDOTO and run a free scan of Windows and external devices. Review the findings before deciding on remediation, which requires a license. See the licensing plans and Resource Center. Detections and outcomes depend on the individual case.