Post

Useful catch either way. When an agent flags something like this, have it list the exact paths, launch agents and process info, then verify yourself before anything gets deleted. Spotting is easy, forensics isn't.