Question Strange malware found with Emsisoft running in HirensBoot PE?

taisingera

Golden Member
Dec 27, 2005
1,034
2
81
#1
I wanted to see if Emsisoft Emergency Kit would run in a PE environment. So I copied it to a Hirens Boot PE and ran it. It worked and found 1 malware, Rogue.Win32.FakeOpt(A) in the Recovery partition of windows 10 under the folder \Users\Default\AppData\Roaming\Microsoft\Windows\StartMenu\Programs\WindowsRecovery\

The only file in there was a Lazesoft Windows Recovery exe. I checked and found that there is such a company that supplies such software. Is this a false positive on Emsisoft or is Microsoft really using 3rd party, possibly suspect software for recovery?
 

taisingera

Golden Member
Dec 27, 2005
1,034
2
81
#2
Nevermind, the detection is actually on the BOOT partition of the HirensBoot PE. It is strange though how it detected the start menu item as malware but the program itself included with Hirens did not trigger a warning.
 

Similar threads



ASK THE COMMUNITY

TRENDING THREADS