runasadmin shim confused with Nurech?

[emartinwilkinson]

I think that SpyBot has confused the SHIM "runasadmin" with a Nurech trojan/ downloader. It is flagging something wrong with a registry entry in ...\winlogon\shell not being explorer.exe, which of course it will not be using this security software.

I am happy with being flagged for such a major change, but not so much with this simple identification.

Windows Defender does not appear to find anything, which is rather surprising.

Or have I got the wrong end of the stick?

cheers

MartinW

[Yodama]

hi,

yes it is a false positive, we had no intention of flagging changes made by "runasadmin".

this will be fixed with the next update expected for the middle of next week.