Hi everyone,
I’ve been experiencing an odd issue on my Windows 10 computer where, roughly every 6–8 days, the cmd.exe and reg.exe processes begin looping endlessly. At the same time, Avast shows pop-ups warning about threats like "cmd.exe infected with Win32:Banload-GGV [Trj]" and more recently "Win64:Expiro-AJ [Inf]".
I know this last one sounds serious, but it may be a false positive. I ran full scans using both Avast and Malwarebytes, and nothing significant was found, only some older game cracks and similar files, which I’ve already quarantined. I also scanned the Rainmeter program, its skins (especially the Volume one), and related files using VirusTotal, and everything came back clean.
After some investigation, I discovered that this behavior is triggered by the Rainmeter skins I have running. These include: "HardDrive", "Volume", "Performance - Combo" and "DateTime"
When Rainmeter is running, the looping starts. When I disable Rainmeter, the looping stops immediately. All the skin files show a "last modified" date from 2016, except one with a 2024 date (though its contents looked normal when I checked manually).
For transparency: I do still have some old cracked software on the system, but I haven’t downloaded or added anything new in months. I’ve read about similar virus detections online, but most of those cases involved people knowingly installing infected cracked software (e.g. cracked Adobe apps). This doesn’t seem to match my case, especially since all scans are clean and the behavior is specifically tied to Rainmeter.
So my question is:
Has anyone else experienced similar issues with Rainmeter triggering antivirus alerts or looping system processes? Could this be a compatibility issue, a bug in an skin, or something else entirely?
Any thoughts or advice would be greatly appreciated. Thank you in advance!
I’ve been experiencing an odd issue on my Windows 10 computer where, roughly every 6–8 days, the cmd.exe and reg.exe processes begin looping endlessly. At the same time, Avast shows pop-ups warning about threats like "cmd.exe infected with Win32:Banload-GGV [Trj]" and more recently "Win64:Expiro-AJ [Inf]".
I know this last one sounds serious, but it may be a false positive. I ran full scans using both Avast and Malwarebytes, and nothing significant was found, only some older game cracks and similar files, which I’ve already quarantined. I also scanned the Rainmeter program, its skins (especially the Volume one), and related files using VirusTotal, and everything came back clean.
After some investigation, I discovered that this behavior is triggered by the Rainmeter skins I have running. These include: "HardDrive", "Volume", "Performance - Combo" and "DateTime"
When Rainmeter is running, the looping starts. When I disable Rainmeter, the looping stops immediately. All the skin files show a "last modified" date from 2016, except one with a 2024 date (though its contents looked normal when I checked manually).
For transparency: I do still have some old cracked software on the system, but I haven’t downloaded or added anything new in months. I’ve read about similar virus detections online, but most of those cases involved people knowingly installing infected cracked software (e.g. cracked Adobe apps). This doesn’t seem to match my case, especially since all scans are clean and the behavior is specifically tied to Rainmeter.
So my question is:
Has anyone else experienced similar issues with Rainmeter triggering antivirus alerts or looping system processes? Could this be a compatibility issue, a bug in an skin, or something else entirely?
Any thoughts or advice would be greatly appreciated. Thank you in advance!
Statistics: Posted by Mario_Kunchev — May 30th, 2025, 6:21 pm — Replies 4 — Views 2668