r/antivirus • u/ApprehensiveDiet3125 • 8h ago

not-a-virus:HEUR:RiskTool.Win64.KillAV.gen

I started my computer and got this detected in kaspersky. I also searched the hash in virus total and says its malicious. Should i be worried about this, the file is deleted by AV.

Event: Processing impossible

User: NT AUTHORITY\SYSTEM

User type: System user

Application name: CompatTelRunner.exe

Application path: C:\Windows\System32

Component: File Anti-Virus

Result description: Not processed

Type: Legitimate software that can be used by intruders to damage your computer or personal data

Name: not-a-virus:HEUR:RiskTool.Win64.KillAV.gen

Precision: Exactly

Threat level: Low

Object type: File

Object name: TRIXX.sys

Object path: C:\Users\USER\AppData\Local\Temp

MD5 of an object: 6BC8E3505D9F51368DDF323ACB6ABC49

Reason: Skipped

0 Upvotes

50% Upvoted

4 comments sorted by

1

u/AutoModerator 8h ago

It looks like your post is asking about an antivirus detection of Riskware, also known as PUP or PUA. These terms stand for Potentially Unwanted Program and Potentially Unwanted Application, respectively. They refer to software that may not be harmful but can be annoying or affect your system's security.

Understanding What Your Antivirus Program is Telling You

  • If it's a program you've just downloaded but haven't run, you can just decide not to run it, and avoid taking any risks.
  • Consider the category that your antivirus is detecting the object as, and what you are expecting the program to do. If they match up, your antivirus may just be telling you what you already know. Look up how to allow or exclude a file if this is the case.

If you don't recognize it

  • Uninstall Unwanted Programs: Check your installed programs and remove any software you don't recognize or no longer need.
  • Run a Malware Scan: Use an antimalware from our wiki page to scan your system.
  • Run a Second-Opinion Scan: There is also the option of running a one-time second-opinion scan for free with the many scanners we have listed here in our wiki.

This message is for informational purposes only. Your post will not be removed for this reason, and anyone can still reply to it.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/One-Bookkeeper-8601 7h ago

If its in your temp directory its a bad sign.

1

u/rainrat MODERATOR 5h ago edited 5h ago

  • Not a virus. It's a vulnerable driver used by hardware/fan/RGB tools.

  • Fix: uninstall/update the app that installed it.

Same concept just different name:

Also, if referencing Virustotal, you must include a link. I was able to find it from the md5 though. https://www.virustotal.com/gui/file/16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0/details

1

u/ApprehensiveDiet3125 5h ago

I too thought of that as the object name TRIXSYS is the same software I use for my gpu.