-3

I get a virus report from TrendMicro-HouseCall, that the file aescn.dylib(sha256 ae96a241177e0c46cd70892593eb7af5a76fad5175bfb76681a85bf270af777d) is a virus called Keypress-9.

I checked it on VirusTotal.

When I delete the file, the antivirus doesn't work. What should I do? What is happening?

closed as off-topic by Rory Alsop Jun 16 '16 at 13:17

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Did you actually install this TrendMicro-HouseCall, or did you get a random email/phonecall about it, out of nowhere? – Ben Jun 15 '16 at 22:37
  • @Ben, obviously I don't know, but the VirusTotal report for that file confirms that TrendMicro House Call detected the file as malicious, and as a malware called Keypress-9. – A. Darwin Jun 16 '16 at 7:41
  • i used a security tool called Task Explorer from objective-see.com and this tool checks every file with virustotal and so I found this. Any suggestion what to do? – Michael Kohlhaas Jun 16 '16 at 8:57
  • We have general guidance when you have an infection you cannot track down: wipe the machine completely and rebuild. The issues you have may be specific to your machine, and off topic here. – Rory Alsop Jun 16 '16 at 13:17
  • My GUESS is that you deleted a signature file Avira uses to detect viruses, or some sort of hook file that Avira uses to monitor processes in a very low-level way that is hard for malware to hide from, but using methods which would look suspicious for any "normal" process to do. In general antivirus programs often do not "play nice" together. Either way, you deleted a file Avira needs, so the best bet would be to reinstall Avira from fresh download (download directly from Avira, and verify any hash/signature available). If the file is recreated on installation I'd guess "false positive". – Ben Jun 16 '16 at 13:37
1

There is a file named aescn.dylib, which is part of Avira Free Mac Security, but I don't know if the hash you quoted coincides with that of the legitimate file. You can find the SHA256 of that file by submitting the link to download the specific version of Avira (from the Avira website) to VirusTotal, and clicking on aescn.dylib under the "Contained files" section of the downloaded file analysis.

If it coincides, it might be a false positive (only TrendMicro detects it as malware), but since Avira is free, you can go the safe way and install it again, or even install other antimalware solutions.

If not, it could be that your version of Avira is actually a rogue antivirus, and thus malicious. In this case, you should definitely uninstall it, and it would probably be not enough. When you install an AV, you give it a lot of permissions, which means that a rogue antivirus could have done a lot of things to your system. The safest way would, unfortunately, to perform a clean install of Mac OS (or another operating system), or even to buy a new computer.

  • @MichaelKohlhaas I'm assuming you are using the free version of Avira. If you're using something like Avira Internet Security Suite (which is not free), you should buy the exact same version in order to compare the hashes, and I don't know if it would be worth it. – A. Darwin Jun 16 '16 at 9:52
  • thanks. so buying a new macbook would be to expensive. I never did a clean reinstall, but when i recover then files from the backup, it could be something infected. I go sometimes in the darkweb and i could easly get infected with some goverment grade shit that is somehow persistent und untraceable. So i just downloaded a fresh install .pkg file from avira, tried to extract files with unarchiver, i can make first step, but i get some files out but not the aescn.dylib. So i get another pkg file which i cant extract, i get an error, that it is corrupted. I tried it several times. Its annoying – Michael Kohlhaas Jun 16 '16 at 13:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.