7

The name of the service is a 32-digit hex number. It might be randomly generated, since a Google search on the number did not find anything. It points to an EXE file which also has a hex number as name, in a folder which also have a hex number as name.

I suspect this could some kind of malware, since the naming looks so strange, but a malware scan did not flag it. It might also be legitimate software which just have strange names for some reason.

In the Details-tab of the EXE file properties, the file description is blank, but there is a product version ("3.13.11.3") and Copyright ("Copyright (C) 2014") which doesn't help me a lot.

The question is: How do I identify what program the service actually is, since the file names do not give any clue?

9
  • The properties of the .exe file should show some information about the author, name, version etc. in the Details tab ... at least for legitimate applications. Commented Apr 26, 2017 at 8:35
  • 3
    Maybe try this technet.microsoft.com/en-us/sysinternals/processexplorer.aspx and see which process is using that .exe?
    – Mugurel
    Commented Apr 26, 2017 at 8:36
  • @Mugurel: Thank you for the suggestion, but I have stopped and disabled the service until I am sure it is legitimate software.
    – JacquesB
    Commented Apr 26, 2017 at 8:52
  • 5
    It sounds very suspicious ... if I were you I'd nuke the server from orbit and restore backups. Commented Apr 26, 2017 at 9:25
  • 2
    @adiuva: Thanks, this helped me identify the software - it was a well-known adware. If you write this as an answer I will accept.
    – JacquesB
    Commented Apr 26, 2017 at 10:14

1 Answer 1

16

Did you try uploading the file to virustotal.com for a broader scan?
But in general I agree with Gerald Schneider. Take the server off the network, restore it and check other Servers / Clients for suspicious files / processes and activities.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .