Has anyone been reporting false positives for rootkits on new Windows 10 or upgraded Windows 10 machines? The WSAC notification icon has been displaying as "Infected" once a week, but when I scan my computer, the scan returns negative. Last week, I removed what WSAC pinged as 4 rootkits pertaining to:
HKLMSystemCurrentControlSetServicesOneSyncSvc_Session;
HKLMSystemCurrentControlSetServicesPimIndexMaintenanceSvc_Session;
HKLMSystemCurrentControlSetServicesUnistoreSvc_Session; and
HKLMSystemCurrentControlSetServicesUserDataSvc_Session.
This afternoon, my WSAC icon again displayed "infected" and I ran (and saved) a scan which returned negative; but the threat log identified the same 4 items listed above.
I'm inclined to believe that the items above were removed based on the policies I've implemented on my machine, and I'll check my event logs to verify that Windows reinstalled those items; however, the nastiness of rootkits is why I am asking for input before I tell WSAC that they are authorized processes.
Thank you,
Krieger_bot
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.