executing exec('wmic process call create notepad') causing McAfee to quarantine cmd.exe

325 Views Asked by At

In windows command line prompt the command wmic process call create notepad will open notepad and also report the process Id. This command work fine on my computer.

However, running this command via php exec() function causing McAffe to recognize it as a virus threat TIE/Suspect!.

o.php file:

 <?php
    exec("wmic process call create notepad");

Immediately after running php o.php C:\Windows\System32\cmd.exe is moved to Quarantine by McAfee

At this point I'm sure this is false-positive detection

This is not related to notepad because with any other command I have the same effect

The command exec("notepad"); works fine

Because of that problem my php project is not working when antivirus is turned on Any suggestion will be appreciated

0

There are 0 best solutions below