BITDEFENDER JUST DID COMPLETE SCAN AND DELETED WINDOWS 11 FILE secureboot64.exe

John Dunham · 2025-06-05T22:21:54+00:00

There was an error rendering this rich post.

Yep, this just happened yesterday after I started a full scan of my Windows 11 PC. It took several hours to scan my PC and I woke up today to the report stating only 1 file had a problem. I looked at the log and saw, "C:\ProgramData\Microsoft\Windows\SystemSecure\Modules\System\secureboot64.exe" was recognized as Trojan.Agent.GLNF and was deleted.

I am not worrying right now about checking to see if I have BD set to automatically delete all files that are "suspect", because the important thing is that I can't turn off the PC because this file is needed when I restart the PC. I had to use ESET Online scanner to recheck my PC just to be sure it was clean and it was. So I am posting here FIRST to notify BD community that this happened. I searched and did not see online that BD recognized this file as a "false positive", so I hope someone will chime in on any knowledge of this happening and that the STAFF SHOULD LOOK INTO THIS ISSUE.

Right now I'm going to have to replace this file so I can shut down the PC.

Thanks!

UPDATE: Same day….so BD DID NOT DELETE THE FILE (EVEN THOUGH IT SAID IT DID (SO I THOUGHT IT SAID) BUT IT DID PUT IT (AND OTHERS) IN QUARANTINE…SO I RECOVERED! THERE WERE 30 OTHER FILES, SOME .EXE THAT WERE ALSO QUARANTINED - SO I AM RECOVERING ALL BECAUSE I SHOULD NOT HAVE HAD THEM EVEN "SUFFER ME" TO HAVE TO INVESTIGATE EACH AND EVERY FILE. THANKS

Find more posts tagged with

Comments

Alexandru_BD

@dvsls if you are around, what do you think about this?

Flexx

Based on my research online, this is what I found.

The file located at C:\ProgramData\Microsoft\Windows\SystemSecure\Modules\System\secureboot64.exe is not a legitimate component of the Microsoft Windows operating system. It has been widely identified by cybersecurity professionals and users across various technical forums as a malicious executable, most often linked to cryptocurrency mining malware.

The directory C:\ProgramData\Microsoft\Windows\SystemSecure is not a standard Windows folder. It appears to be created by the malware itself to store its components. The naming convention is likely intended to imitate legitimate system directories in order to avoid detection.

The base directory, C:\ProgramData, is a legitimate system folder used to store application data that is not specific to a single user. However, the subpath \Microsoft\Windows\SystemSecure\Modules\System\ is not recognized as part of the official Windows directory structure, particularly not for system files associated with Secure Boot or other core operating system functions.

The executable secureboot64.exe is not associated with Microsoft Secure Boot mechanism or any known Windows process. Secure Boot is a security feature designed to ensure that only trusted software is executed during the startup process. It is managed through system firmware (UEFI) and core Windows components, with related files typically located in protected directories such as C:\Windows\System32 or C:\Windows\Boot.

The presence of a file named secureboot64.exe in a non-standard directory like ProgramData is cause for concern. It may indicate the presence of third-party software, a system misconfiguration, or more likely, malicious software attempting to disguise itself using a name that sounds legitimate. Malware often employs this tactic and may use directories like ProgramData to evade detection, as these locations are generally writable without requiring elevated system permissions.

Regards

John Dunham

Thank you so much for the information. I can confirm that I did have some sort of "unwanted" malicious software onboard my computer. Now that I remember it, I purchased the PC from Ebay and it already had Windows 10 pro on it. Anyway, I "zeroed" out the hard drive and started over with a fresh install (retail) of Windows 10 Professional…then I put the BD on it - ALL IS WELL. So while I through BD was doing something wrong, it actually WAS HITTING ON AND DELETING A BAD FILE(S).

Thank you again!