Microsoft Scheduled Tasks

[scoutt]

We just got hammered on this weeks full scan. A list of what appears to be legit Microsoft Scheduled tasks, here is a small sample. All task that got hit are in the text file. Appears some to be part of the customer experience program, but can't be positive, and some about cleanup on the PC itself.

 

RiskWare.Injector.Generic	Reg, Key	Malware	Quarantined	HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\PLAIN\{86158314-60CF-4F3F-85B5-2399327EA496}
RiskWare.Injector.Generic	Reg, Key	Malware	Quarantined	HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{86158314-60CF-4F3F-85B5-2399327EA496}
RiskWare.Injector.Generic	Reg, Key	Malware	Quarantined	HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange
RiskWare.Injector.Generic	File	Malware	Quarantined	C:\WINDOWS\SYSTEM32\TASKS\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange

scheduled tasks.txt

Edited May 19, 2021 by scoutt
forgot the file lol

[shadowwar]

This is a fp and the fix should be published within 15 mins. 

[scoutt]

Thank you sir

[BobSoul]

I got the same - scan ran at 9am eastern got notice 10:50 Am -- So I assume we can restore the quarantined items after the fix and rerun scan

 

[Mektor]

You and me both.

attached report

mbam false positive.txt

[TwinHeadedEagle]

Fix is out in 1.0.40648 database update.

[scoutt]

Does that cover all that I posted or jus the small sample?

[Mektor]

Looks like it should cover all. Just rescanned and no more hits. Had over 40 hits on the prior scan. 

[scoutt]

cool thanks for checking.