Reply to thread

Message

<blockquote data-quote="itman71" data-source="post: 941571" data-attributes="member: 83966">I have an idea why OSA is triggering on execution of C:\WINDOWS\system32\rundll32.exe&quot; -localserver 22d8c27b-47a1-48d1-ad08-7da7abd79617. This is actually Windows Shell Experience Host and it is a &quot;darling&quot; of malware developers. I also believe a recent Win 10 update or the like may have borked how this process runs. It normally runs at Win startup time and then shortly is suspended. What I have recently observed is that this process was not running after system startup. It appears that anything that requires Windows Shell Experience Host use will cause the suspended instance to start and execute. When OSA detects a stand-alone instance of Windows Shell Experience Host attempting to start and execute, it detects it as malicious.I have been also having recent issues with Win Store abnormally terminating shortly after Win 10 startup. It also might be somehow related to this. Yesterday, I ran wsreset.exe to attempt to fix the Win Store issue. It stopped the unexpended abending of it but it appeared a portion was still borked as evidenced by lack of any update connections from it.This morning at first system startup time, I was greeted with a black screen. Hit the case power button to force a cold boot. This time system booted fine, Windows Shell Experience Host started and suspended as expected, and Win Store now shows update connections. Go figure ......................</blockquote>

[QUOTE="itman71, post: 941571, member: 83966"] I have an idea why OSA is triggering on execution of C:\WINDOWS\system32\rundll32.exe" -localserver 22d8c27b-47a1-48d1-ad08-7da7abd79617. This is actually Windows Shell Experience Host and it is a "darling" of malware developers. I also believe a recent Win 10 update or the like may have borked how this process runs. It normally runs at Win startup time and then shortly is suspended. What I have recently observed is that this process was not running after system startup. It appears that anything that requires Windows Shell Experience Host use will cause the suspended instance to start and execute. When OSA detects a stand-alone instance of Windows Shell Experience Host attempting to start and execute, it detects it as malicious. I have been also having recent issues with Win Store abnormally terminating shortly after Win 10 startup. It also might be somehow related to this. Yesterday, I ran wsreset.exe to attempt to fix the Win Store issue. It stopped the unexpended abending of it but it appeared a portion was still borked as evidenced by lack of any update connections from it. This morning at first system startup time, I was greeted with a black screen. Hit the case power button to force a cold boot. This time system booted fine, Windows Shell Experience Host started and suspended as expected, and Win Store now shows update connections. Go figure ...................... [/QUOTE]

Verification