Skip to main content
Hello to all Webrooters :)

 

last night i saw on Webroot > Active processes   LockApp.exe was monitoring ! what was that? i never seen that file before :D

 

Location: Windows > SystemApps > Microsoft.LockApp_cw5n1h2txyewy > LockApp.exe 

 

 
Hi Parham

 

Hope that you are well?

 

Doing a bit of research I have found that LockApp.exe is an important part of Windows and rarely causes problems.

 

But it is worth noting that some malware camouflages itself as LockApp.exe, particularly when located in the C:Windows or C:WindowsSystem32 folder. It would therefor be sensible to check the LockApp.exe process on your PC to see where it is located and therefor if it is a threat or not.

 

The LockApp.exe file is located in a subfolder of C:Windows. Known file sizes on Windows 10/8/7/XP are 2,100,064 bytes (85% of all occurrences) or 1,358,688 bytes.

 

 

Also please this thread from the Microsoft Forums for more information on the later point.

 

Hope that helps?

 

Regards, Baldrick
Hello Baldrick Thank you i'm Ok how R U today ?:D

 

well about this lockapp file i scan it on virustotal : https://virustotal.com/en/file/c21fb0c9295531116622a837683227ae37881fa998acbb5fd427a2cfae3998ec/analysis/

 

and if this is windows process why Webroot was monitoring that ? 😞 i have concern about this file 😞
Hi Parham

 

I am good...thanks for asking.

 

If WSA is monitoring this file it is because it has been unable to determine if it is good or bad; this in itself is normal behaviour in the circumstances and may be due t the fact that the file has recently been updated and at present is not registered in the Webroot Cloud. Monitoring is a precaution until the registration has happened and WSA can class it as either good or bad.

 

As it is being monitored, you are covered, as if it is bad then you are covered and WSA will eventually roll back any action it has taken on your system. If good the monitoring will be stopped as part of the scheduled scan that occurs after the Cloud registration has occurred.

 

Hope that helps?

 

Regards, Baldrick

Reply