Windows 10: C:\Windows\System32\cmd.exe

On Aug 24 when I booted my laptop I got this pop up (see attached). I just clicked on OK and ignored it.

However since then I've gotten several pop ups re this item and in Googling it, I find it could possibly be some kind of malware. This is what I found:
"Please note that this infection is an Alternate Data Stream file attached to the legitimate C:\Windows\System32\ folder. Do not delete the C:\Windows\System32\ folder as Windows will not operate correctly without it. "

Do I need to deal with this, and if so, how?



:)

 

c -0001.c-msedge.net

Monthly large amounts of data are downloaded via Host process for windows with c-0001.c-msedge.net listed as host. This week alone 1.6gb. I am unable to stop this download an am also uncertain of its purpose. Any ideas, suggestions?

 

C++

Unlike Java, Visual C++ updates are not cumulative. Each has unique features.

 

Hi Nikilet.

Did you install WinPatrol ? It appears it has a section called Scotty that monitors Startup programs and it appears to be telling you something change.

17.3.6943.0625 when searched shows all kinds of hits on Microsoft's Onedrive. Did you uninstall it recently or disable it from starting with Windows? It appears to have been updated recently.

I would ensure I had a complete backup of my data created off machine, job one. I would even consider creating an Image with a tool like Macrium Reflect so you can at least return to this point.

Then you could try something like Adwcleaner from Malwarebytes to scan.


Ken

 

Thank you, Ken. I do have Macrium which backs up to an external hard drive. I did mess around with OneDrive recently.

Apparently you don't really feel it is some kind of malware (?) so I guess I will just let this go unless something else happens.

 

Sorry I can't be 100% sure. You didn't say, did you install WinPatrol?

It does line up, that is the OneDrive mentioned on the Web and then you making changes. If you have a Macrium backup I think you could run the AdwCleaner. Just make sure your data is also backed up

 

One drive often runs a CMD to delete all files in one drive then another to update its normal allow it

 

No, it runs it from %localappdata% not system32.

It doesn't assume full authority.

 

Yes, I do have WinPatrol Plus. I've had it for years.

 

I used to use Winpatrol for years until it was bought out and regular updates stopped.

Make sure you have the latest version of it if you must keep it installed.

I saw this link while I was searching: winpatrol asks permission windows command processor on windows 10 - Virus, Trojan, Spyware, and Malware Removal Logs

 

OneDrive was updated on august 24. on my System. I always have Task Manager open in Performance tab when I'm
connected to the web. That way I can easily see what's get downloaded. When I notice something, I open the Perfomance
Monitor on Network tab and there I see who or what is downloading.