I am trying to find out why this process appeared during 2 boot occasions. Autoruns does not show it anywhere. It appeared when I uninstalled google chrome and malwarebytes. The prefetch file for makecab.exe (makecab is an official microsoft process) showed it was created yesterday, and modified today (it ran once today and yesterday very briefly - no more than 10 seconds at boot. I've uninstalled the 2 programs before at the same time in the past multiple times, and have never seen this pb.exerocess. However, usually I delete EVERY file associated with those programs including registry when I did uninstall them.
Is there any reason why makecab.exe would run? I've used process explorer, but the process starts and ends too quickly for me to see what starts it. However, its only twice I've seen it appear, and thats after uninstalling chrome and mbam, both times I did not have process explorer ready.
Should I be worried about this? Or has it a legit reason for running?
I've noticed it begins around the same time as the windows module installer (comparing prefetch file to event viewer).
I haven't added any programs; I only saw this after uninstalling these programs, but as I said I usually delete the files manually. I've uploaded the versions of makecab onto virustotal and they're all clean.
I couldn't find anything in the registry other than a value which listed various system processes, however exporting it as a text file shows it hasn't been edited for years.
How can I find out what is starting it? I've rebooted various times with process explorer and nothing happened, I installed malwarebytes to scan, I did a full scan and found nothing, and installed chrome again. After the scan, I uninstalled the 2, and then while NOT using process explorer, but the normal task manager, I saw it again after I rebooted.
Is there a way I can make process explorer extend the time it shows killed processes?
