CSC.exe Generates WIN32:EVO-GEN [Susp] in temp

Viruses and worms
1

I have been getting periodic avast warnings of WIN32:EVO-GEN [Susp] It involves DLL files being generated in the windows temp location.

I can edit the .out file and it seems to be doing things.

Let me know if you guys have any ideas.

Here is the cut paste of a file it generated

C:\WINDOWS\system32> “C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe” /t:library /utf8output /R:“System.dll” /R:“System.Data.dll” /R:“System.Management.dll” /R:“System.ServiceProcess.dll” /R:“System.Xml.dll” /out:“C:\WINDOWS\TEMP\pjqdg2ps.dll” /debug- /optimize+ /t:library /d:TRACE “C:\WINDOWS\TEMP\pjqdg2ps.0.cs”

Microsoft (R) Visual C# Compiler version 4.6.1038.0

for C# 5
Copyright (C) Microsoft Corporation. All rights reserved.

This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240

c:\Windows\Temp\pjqdg2ps.0.cs(1593,87): warning CS0618: ‘System.Threading.WaitHandle.Handle’ is obsolete: ‘Use the SafeWaitHandle property instead.’

2

what does the popup message from avast say … post screenshot

if you have not restarted then you can right click avast tray icon and select show last popup

3

Screen Cap of one of the times it popped up.

The system has rebooted but I saved this cap from yesterday

4

If you want a check, follow instructions here > https://forum.avast.com/index.php?topic=53253.0