The name of the service is a 32-digit hex number. It might be randomly generated, since a Google search on the number did not find anything. It points to an EXE file which also has a hex number as name, in a folder which also have a hex number as name.

I suspect this could some kind of malware, since the naming looks so strange, but a malware scan did not flag it. It might also be legitimate software which just have strange names for some reason.

In the Details-tab of the EXE file properties, the file description is blank, but there is a product version ("") and Copyright ("Copyright (C) 2014") which doesn't help me a lot.

The question is: How do I identify what program the service actually is, since the file names do not give any clue?

  • The properties of the .exe file should show some information about the author, name, version etc. in the Details tab ... at least for legitimate applications. – Gerald Schneider Apr 26 '17 at 8:35
  • 3
    Maybe try this technet.microsoft.com/en-us/sysinternals/processexplorer.aspx and see which process is using that .exe? – Mugurel Apr 26 '17 at 8:36
  • @Mugurel: Thank you for the suggestion, but I have stopped and disabled the service until I am sure it is legitimate software. – JacquesB Apr 26 '17 at 8:52
  • 5
    It sounds very suspicious ... if I were you I'd nuke the server from orbit and restore backups. – Gerald Schneider Apr 26 '17 at 9:25
  • 2
    @adiuva: Thanks, this helped me identify the software - it was a well-known adware. If you write this as an answer I will accept. – JacquesB Apr 26 '17 at 10:14

Did you try uploading the file to virustotal.com for a broader scan?
But in general I agree with Gerald Schneider. Take the server off the network, restore it and check other Servers / Clients for suspicious files / processes and activities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.