Was about to login using my password to my bank account, and noticed my personal (selected) id image was not the one it's supposed to be. I have Avast free, so I fired it up and found one threat, a script with high level rating. I restarted afterward and ran a boot scan, in which numerous AH files were found to be corrupted and removed. Of course some of these ended up being launch files, so I'm reinstalling, and hoping my settings folder that I moved over doesn't have any corrupt files too.
Now to the topic, I noticed this script was installed on Dec 24, and only now became active or at least came to my attention. I suppose it could be a browser hijack too, but I tend not to download things. In fact the only thing I've downloaded in the past couple months besides AH stuff were some mods for Men of War Assault squad - from ModDB. It does appear that the mods are the source of the infection, not suggesting AH, but maybe it chose to infect AH files based of usage pattern/habits? The file path was in User/appdata/...These mods are several years old, however I suppose if they get stale maybe it's a ripe place to put malware.
The only out of normal behavior was the possible attempt to steal bank information. After the virus and boot scan, my correct personal id image appeared.
Strange that it waited 'til 6 weeks later to activate, or no? Events like this get me real paranoid that there are other instances that haven't been detected yet, even though I'm very careful in what I download and click on. Thoughts?
