New
#1
SafeBoot Entry Showing in Autoruns
I happened to run Autoruns and noticed the first entry showing as:
"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\AlternateShell" "" "" "" "6/17/2017 1:07 AM" ""
+ "cmd.exe" "Windows Command Processor" "Microsoft Corporation" "c:\windows\system32\cmd.exe" "5/30/2017 3:10 AM" ""
I have never seen this before. I recently installed v13.80 so it seems to have popped up in that version. Anyone see this before? I don't think it is malicious.
JohnD