Author Topic: Another False Positive? PUP RunOnce in registry  (Read 5940 times)

0 Members and 1 Guest are viewing this topic.

September 22, 2018, 06:30:19 PM

Faergor

  • Newbie

  • Offline
  • *

  • 48
  • Reputation:
    0
    • View Profile
Another False Positive? PUP RunOnce in registry
« on: September 22, 2018, 06:30:19 PM »
Hello, again, one hour later.
I did another Roguekiller scan, in safe mode this time, and it found this:

¤¤¤ Registry : 2 ¤¤¤
[PUP] (X64) HKEY_USERS\S-1-5-21-1239764888-2148109162-3447206424-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce | Application Restart #1 : C:\Windows\System32\msconfig.exe %windir%\system32\msconfig [-] -> Found
[PUP] (X86) HKEY_USERS\S-1-5-21-1239764888-2148109162-3447206424-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce | Application Restart #1 : C:\Windows\System32\msconfig.exe %windir%\system32\msconfig [-] -> Found

Is this false positive please? I uploaded text file. Thanks

Reply #1September 22, 2018, 08:55:30 PM

Curson

  • Global Moderator
  • Hero Member

  • Offline
  • *****

  • 2809
  • Reputation:
    100
    • View Profile
Re: Another False Positive? PUP RunOnce in registry
« Reply #1 on: September 22, 2018, 08:55:30 PM »
Hi Faergor,

These entries are present as RunOnce keys used to modify system startup with MSConfig tool.
You can safely ignore them, but they should be gone on next reboot.

Regards.