Kao Posted June 16, 2022 ID:1520644 Share Posted June 16, 2022 Hello. So I was on Windows 10 and a few days ago upgraded to Windows 11. Because of that, I have the Windows.old folder in my C: drive still. I've done daily scans since then and haven't found anything, yet when I scanned tonight it detected two things which made me a bit paranoid. Trojan.ShellCode, C:\WINDOWS.OLD\WINDOWS\SYSWOW64\CMD.EXE Trojan.ShellCode, C:\WINDOWS.OLD\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-COMMANDPROMPT_31BF3856AD364E35_10.0.19041.746_NONE_735ABBDBAD8C902F\CMD.EXE They're both cmd.exe from the Windows.old folder. Was this detected because they're not the actual cmd files from the current Windows installation? Is this a false positive? And if so, why didn't it detect this on my previous scans? Any information would be greatly appreciated to help ease my paranoia. Not sure what to do or think at the moment, right now I'm just overthinking everything that I possibly could've done to had this happen, I really hope it's not actual malware. Thank you. Link to post Share on other sites More sharing options...
Kao Posted June 16, 2022 Author ID:1520647 Share Posted June 16, 2022 Not sure if I can edit, but I just wanted to add this. I get very paranoid about all this sorta stuff so maybe I'm overthinking it. My fear at the moment is that it *isn't* a false positive, and in the timespan between my previous scan and the one I did just now, those cmd.exe files somehow got 'infected.' Hope that's not the case, but maybe I'm just being paranoid. Either way, any information would be greatly appreciated, thanks everyone. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 16, 2022 Root Admin ID:1520648 Share Posted June 16, 2022 Please post the actual log file Link to post Share on other sites More sharing options...
Kao Posted June 16, 2022 Author ID:1520649 Share Posted June 16, 2022 My bad, here it is Log.txt Link to post Share on other sites More sharing options...
Staff miekiemoes Posted June 16, 2022 Staff ID:1520664 Share Posted June 16, 2022 Hi, This will be fixed in next database update. Thanks for reporting! Link to post Share on other sites More sharing options...
Kao Posted June 16, 2022 Author ID:1520806 Share Posted June 16, 2022 13 hours ago, miekiemoes said: Hi, This will be fixed in next database update. Thanks for reporting! Hi, thank you for responding. So this is for sure a false positive? If so, why wasn't it detected on the prior scans? Please let me know, thank you! Link to post Share on other sites More sharing options...
Staff miekiemoes Posted June 17, 2022 Staff ID:1520862 Share Posted June 17, 2022 Hi, Yes, this was a false positive. This wasn't detected earlier, because this detection was only added recently. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now