Windows 10: Are these non verified files normal on autoruns.exe?

Hello, are these files official? Or are these some fake malwares? I checked the sign, they arent verified but some of them got signed in properties in 7 May. Are these normal?Note: I uploaded some of them on virustotal, it said there were no malware.

:)

 

Is it normal for some Microsoft entries to appear as not verified on autoruns?

Hi Sammy,

This seems to be a bug in Autoruns. Please check out the responses from "markc(msft)Microsoft" in the following link:

• Windows Defender executables: Publisher - (Not Verified) Microsoft Corporation
  

Quoting MarkC:

I traced this to an issue with the way that autoruns handles protected folders. For Microsoft published binaries we have an additional validation step that confirms whether or not the binary is in a protected system folder. For ProgramData this is not the case. The Windows Defender folder however IS locked down so I'm just waiting for confirmation from Mark R. that it's OK to add this and I'll get the fix updated.

Alternatively, you can run SigCheck.exe to know if the binaries are signed or not.

• Sigcheck - File version and signature viewer
  

 

Is it normal for some Microsoft entries to appear as not verified on autoruns?

Hi SammyTammyRed

I am Dave, I will help you with this.

Rest assured, it is normal form some genuine Microsoft process to not be verified in Autoruns, many people have reported this and all those processes are in the correct location, they are legitimate Microsoft services and entries, you do not need to worry about those, they are not related to malware.

 

How to locate an EXE file that I have just installed?

I respectfully suggest that you might be treating the zipped EXE file as if it were a file that does not actually need to be installed. Double-clicking such a file causes the prog to be launched immediately. An example of a non-installable EXE file would be some of the SysInternal files, such as ProcMon and Autoruns.

The file that you quoted, oldcalcwin10.zip, is the same file as in my other post. Double-clicking on that file launches an install dialog. At no time does the calculator itself appear. To launch the calculator, I needed to click on SYSTEM32\calc1.exe

Summarizing:

- Double-clicking an installable EXE file launches the installer.
- Double-clicking a non-installable EXE file launches the program itself.

Note that I have already created a shortcut to calc1.exe on my desktop. "If it works, don't break it!" Therefore, no other helpful suggestions are needed *Smile

Thanks to all the generous volunteers for their responses.
.