SecureBootEncodeUEFI.exe keeps opening a shell window that vanishes after a few seconds in Windows 10

Question

I noticed this happening a few days ago, my computer never did it before. A shell window keeps flashing on my screen at random intervals, too fast to see what it is. I finally opened task manager and sat there staring at it until I caught the name of the program. As per the title, it is SecureBootEncodeUEFI.exe

I've got the May 9 update installed, but it's still doing it.

How do I find out if this is a malicious program and how do I deal with it?

Answer 1

I am noticing this behavior on Server 2019 starting in May 2023. The window appears multiple times throughout the day, but disappears so quickly that I can't see what program ran. My first instinct was to check for malware. My MalwareBytes scan came back clean.

I enabled the audit process tracking in my security policy, and when I saw the window flash I quickly went to Event Viewer and there I saw SecureBootEncodeUEFI.exe.

I am seeing SecureBootEncodeUEFI in the Task Scheduler configured the same way as reported earlier in this thread.

Can someone from Microsoft explain what this executable is doing and why it has started running multiple times a day?

Answer 2

I got this on an old PC that does not support Secure Boot, but not on two PCs that do support Secure Boot (and have it enabled).

Is this issue only manifesting itself on PCs without Secure Boot support (or have it disabled)?

BTW, all PCs are running W10 22H2

Answer 3

Hello,

To determine if "SecureBootEncodeUEFI.exe," is malicious or potentially unwanted, you can take the following steps:

First, scan your system for malware using good antivirus software. Make sure it's up to date and let the scan finish. Then, if it recommends anything, follow the instructions provided.

Next, do an internet search for the program and include the words "virus" or "malware." Check if there are any reports of it being associated with malicious activity. Look out for info that suggests it's a legit system file or a known threat.

Finally, find the file on your system, right-click on it, and select "Properties." Then, go to the "Details" or "Version" tab and check out the file's location, digital signature, and other properties. Legit files usually have a valid digital signature and are in specific system folders. If it's in an unusual location or lacks a digital signature, it could be suspicious.

Hope this helps!