1.    29 Aug 2017 #1
    Join Date : Mar 2016
    Posts : 91
    Windows 10

    C:\Windows\System32\cmd.exe


    On Aug 24 when I booted my laptop I got this pop up (see attached). I just clicked on OK and ignored it.

    However since then I've gotten several pop ups re this item and in Googling it, I find it could possibly be some kind of malware. This is what I found:
    "Please note that this infection is an Alternate Data Stream file attached to the legitimate C:\Windows\System32\ folder. Do not delete the C:\Windows\System32\ folder as Windows will not operate correctly without it. "

    Do I need to deal with this, and if so, how?Click image for larger version. 

Name:	info box.JPG 
Views:	42 
Size:	50.3 KB 
ID:	151021
      My ComputersSystem Spec
  2.    30 Aug 2017 #2
    Join Date : Oct 2016
    Caledon, Ontario, Canada
    Posts : 4,090
    Windows 10 Pro Build 1703

    Hi Nikilet.

    Did you install WinPatrol ? It appears it has a section called Scotty that monitors Startup programs and it appears to be telling you something change.

    17.3.6943.0625 when searched shows all kinds of hits on Microsoft's Onedrive. Did you uninstall it recently or disable it from starting with Windows? It appears to have been updated recently.

    I would ensure I had a complete backup of my data created off machine, job one. I would even consider creating an Image with a tool like Macrium Reflect so you can at least return to this point.

    Then you could try something like Adwcleaner from Malwarebytes to scan.


    Ken
      My ComputerSystem Spec
  3.    30 Aug 2017 #3
    Join Date : Mar 2016
    Posts : 91
    Windows 10
    Thread Starter

    Thank you, Ken. I do have Macrium which backs up to an external hard drive. I did mess around with OneDrive recently.

    Apparently you don't really feel it is some kind of malware (?) so I guess I will just let this go unless something else happens.
      My ComputersSystem Spec
  4.    31 Aug 2017 #4
    Join Date : Oct 2016
    Caledon, Ontario, Canada
    Posts : 4,090
    Windows 10 Pro Build 1703

    Sorry I can't be 100% sure. You didn't say, did you install WinPatrol?

    It does line up, that is the OneDrive mentioned on the Web and then you making changes. If you have a Macrium backup I think you could run the AdwCleaner. Just make sure your data is also backed up
      My ComputerSystem Spec
  5.    31 Aug 2017 #5
    Join Date : Jul 2016
    Crewe Cheshire
    Posts : 1,463
    windows 10

    One drive often runs a CMD to delete all files in one drive then another to update its normal allow it
      My ComputerSystem Spec
  6.    31 Aug 2017 #6
    Join Date : Jul 2015
    Posts : 3,755
    10 Pro

    Quote Originally Posted by Samuria View Post
    One drive often runs a CMD to delete all files in one drive then another to update its normal allow it
    No, it runs it from %localappdata% not system32.

    It doesn't assume full authority.
      My ComputerSystem Spec
  7.    31 Aug 2017 #7
    Join Date : Mar 2016
    Posts : 91
    Windows 10
    Thread Starter

    Yes, I do have WinPatrol Plus. I've had it for years.
      My ComputersSystem Spec
  8.    31 Aug 2017 #8

    I used to use Winpatrol for years until it was bought out and regular updates stopped.

    Make sure you have the latest version of it if you must keep it installed.

    I saw this link while I was searching: winpatrol asks permission windows command processor on windows 10 - Virus, Trojan, Spyware, and Malware Removal Logs
      My ComputersSystem Spec
  9.    31 Aug 2017 #9
    Join Date : Dec 2016
    Posts : 164
    Win 10 rs1 - build 14393.1794

    OneDrive was updated on august 24. on my System. I always have Task Manager open in Performance tab when I'm
    connected to the web. That way I can easily see what's get downloaded. When I notice something, I open the Perfomance
    Monitor on Network tab and there I see who or what is downloading.
      My ComputerSystem Spec

 


Similar Threads
Thread Forum
Solved Writing File to \Windows\System32 denied. Workaround?
This may be in the wrong section of the forum. If so, I apologize. I have changed the icons on my desktop to get rid of the shortcut arrow. That worked fine except that the icon now has a small outline where the arrow should be. I have a...
General Support
C:\windows\system32\nvscap64.dll
running windows 10pro vers1511 on my pc os build 10586.589, prod id 00330-80000-00000, each startup this message appears, could not find C:\windows\system32\nvspcap64.dll, what's wrong?:sick:
Windows Updates and Activation
C:\Windows\System32\reg.exe on start up
Every startup I get a command prompt window running reg.exe. There's nothing in my startup folder with reg.exe Noting in the usual registry start up locations with reg.exe Nothing in msconfig with reg.exe Anyone know why it's doing this?
General Support
Windows 10 Unresponsive, 4hours+ to login desktop won't load, system32
Hey all, I've been running windows 10 on my Toshiba satellite i3 core laptop successfully for about a month or two until a week ago when I went to print something it all of a sudden became super unresponsive. No programs would open, shut,...
General Support
[.ShellClassInfo] LocalizedResourceName=@%SystemRoot%\system32\windows
Each time I start up my Windows 10 laptop I get a small page headed "Desktop-Notebook" followed by a display that reads "LocalizedResourceName=@%SystemRoot%\system32\windows.storage.dll,-21826" Have Googled this sentence and tried one suggestion...
General Support
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 17:32.
Find Us
Twitter Facebook Google+ Ten Forums iOS App Ten Forums Android App



Windows 10 Forums