why the McShiled.exe creating the create file events

[Former Member]

Hello Folks,

I was doing the eicar test by running the process monitor. as expected VSE found that notepad file infected and deleted it from the system.

My question is

> Explorer.exe is creating the create file events for eicar.txt which is expected.

> but why McShiled.exe is doing the create a file operation ?

Any feedback will be appreciated

Regards,

Ajay