Safe or Virus

Hi

I've just noticed when I turn my machine on a command box pointing to and starting winda.exe.

Is this a genuine Windows Defender exe or is it mining or a virus ?



Windows 10 64bit

Hello Woodnome,

You should be able to find the full path of the exe in Task Manager and submit it to virustotal.com to do an online check.

I would also suggest a full scan with Windows Defender and Malwarebytes Free to rule out concerns.

Yup...

C:\Users\user\AppData\Roaming\winda.exe

Automated Malware Analysis Report for frF39bBsa7.exe - Generated by Joe Sandbox

MaloK said:

Yup...

C:\Users\user\AppData\Roaming\winda.exe

Automated Malware Analysis Report for frF39bBsa7.exe - Generated by Joe Sandbox

Other than that one site, I find no other references to winda.exe

Thanks guys

Already half way through using the task manager and Defender caught it as a Trojan.

Thing is, why wouldn't it have been caught from the first instance ??

steve108 said:

Other than that one site, I find no other references to winda.exe

That's why I prefer Joe's sandbox. The community reported the file as an high risk Executable, check the whole report.

That is Impressive data collection and analysis... Imo.

Woodnome said:

Thanks guys

Already half way through using the task manager and Defender caught it as a Trojan.

Thing is, why wouldn't it have been caught from the first instance ??

Great question. Maybe it's a brand new Trojan that just got added to the Windows Defender signature file you have.

Thanks for the update that you found it. Did it get cleaned/removed by Defender

Bree said:

No. Here's a report from 2009 of MBAM detecting it....

And Def... didn't see it coming ???... No variant since that time...