On Windows 11, Process Monitor shows File Explorer creating a folder named "myapp-update" in the Temp directory during startup. Windows Defender flags MyAppSetup.exe inside it as a Tnega trojan or adware. The folder also contains bat-alive.flag, run-update.bat, run-update-hidden.vbs, send-status.ps1, and update.log. This started after a Windows update, although I had also downloaded several files that day, so I'm not sure whether the events are related. Could this be a legitimate unfinished installer, or should I treat it as malware?
2 Answers
The update.log could provide a useful clue about which program created the folder and what it was trying to do. Also, the source matters: think back to the installers or downloads from that day and check their publishers and hashes if available. Preserve the log and the detection details, but quarantine the flagged executable and investigate startup tasks or recently installed software that may be triggering the files.
A Windows update normally shouldn’t be dropping a collection of VBScript, batch, and PowerShell files into Temp, especially when Defender identifies the installer as adware. I’d treat it as suspicious rather than assuming it’s part of Windows. Run a full Defender scan, then get a second opinion with reputable on-demand scanners such as Malwarebytes or HitmanPro. Avoid launching any of those files while investigating.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures