As Intended: Are these False Positives?

H

Harry07

New member
Spybot SD keeps on finding these (I do not delete them because I don't know if I damage something by deleting):

Microsoft.Windows.AppFirewallBypass: [SBI $9FD0556E] Instellingen (Registerwaarde., nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\usmt\migwiz.exe

Microsoft.Windows.AppFirewallBypass: [SBI $9DD943AA] Instellingen (Registerwaarde., nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\system32\usmt\migwiz.exe
 
hello,

what Spybot finds here is a firewall setting. In this case the migration wizard is allowed to act as "server" through the windows firewall. This is only required if you export your system files and/or settings (windows migration) through the network to another computer. By default Windows will try to allow the migration wizard to act as a server through the windows firewall even if you migrate locally (for instance to a local hard disk).

There are some trojan horses replacing the seldom used migration wizard and using the fact that it is allowed to act as a server through the firewall.

It is recommended to fix this issue. If you do a migration through the network you can always allow the migration wizard to bypass the firewall.
 
You must log in or register to reply here.
Back
Top