Windows 10: Hundreds of hidden Chrome now IE processes after installing software

Thanks again for your help on this *Smile. Unfortunately I just discovered yet another new interstat / Weatherman variant compiled in April, WeatherForecast, detected by no providers. It is version 1.0.3.40, compared to older version number 1.0.3.18 had by previous Weatherman and variants. Either they suddenly took over a new leaf since writing the original Weatherman trojan, and are just writing benign helpful programs, or they just made it more adept at avoiding detection - maybe by detecting a test system environment? Or maybe all these newer variants have simply not been specifically tested, only heuristically scanned?

https://www.virustotal.com/en/file/1d44605d58be5df7fe72a3412b486186d56d485365babf26f06efcfdd84efcf5/analysis

And another of variant Network Monitor with varying version numbers, now detected by 15 providers as a Trojan

1.3.4.2
1.3.4.3
1.4.3.2

confirmed links to interstat from variant filenames in strings interstat.exe inetstat.exe bandwidthstat.exe

https://www.virustotal.com/en/file/6...9379/analysis/

 

I don't understand - are you saying you installed this on your clean install? Where did it come from? What programs have you installed? It would have had to come in with something (a PUP).

 

Lol, no*Smile, fortunately not, just me being obsessive trying to find other clones of this malware, especially ones that look like they actually have been analysed properly by some AV/anti malware providers.

 

Oh good! WHEW! *chuckle
Please go ahead and mark the thread as solved, unless there is something else that needs attention on your system. Cheers!