MBAM detecting WinPatrol registry key as an infection.

[_MS_]

 

[McLovin]

It could be a False Positive?

 

[_MS_]

Yep, possibly.

 

[McLovin]

When did you receive this?

 

[_MS_]

Today only.

 

[Deleted member 178]

i have Winpatrol installed in my machine, but im on a x64 system, and i checked my registry, and i don't have this reg key at this location. delete it by MBAM and see if winpatrol still function.

 

[McLovin]

Ahh, okay. Well I would say it is only a false positive.

 

[_MS_]

Deleted the key and WP is working fine.

 

[bogdan]

The keys created in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options allow the redirection of the excution of one application to another. Both malware and legit apps use those keys, for example third party task managers like Process Hacker and Process Explorer use them to replace the Windows Task Manager.

 

[_MS_]

Hmmm... thanks bogdan for the explanation.

 

[jamescv7]

It happened to me before, but not in MBAM FP and its through other on demand scanner that detected it. Since I configured Process Hacker to make it default as task manager.

Its pretty normal as long its a legit application.