Quantcast
Channel: All Norton 360 posts
Viewing all articles
Browse latest Browse all 4287

Re: Info about the 2 processes.

$
0
0

Hi neilpatrick7:

 

You might be able to find additional information on afile.exe using Microsoft Sysinternals' free Process Explorer.  Just unzip the downloaded ProcessExplorer.zip file and double-click on the procexp.exe executable to launch - there's no installation required.

 

You can get detailed information on afile.exe by configuring Process Explorer as follows:

 

  1. Enable Options | TotalVirus.com and Options | Verfify Image Signature - this activates automatic file analysis with VirusTotal.com from inside Process Explorer (see here for additional information).
  2. Enable View | Select Columns | Process Image | Image Path - this displays the path to the file.
  3. Close and re-start Process Viewer.

Then check the details for afile.exe, paying special attention to the Version, Path, Verified Signer and Virus Total columns.  A high detection rate in the Virus Total column (e.g., 15/50) means that several different antivirus programs have previously analyzed a file with the identical signature (hash tag) and found it to be suspicious.

 

Process Explorer Sample.png

 

If Process Explorer finds afile.exe in a temp folder like C:\Documents and Settings\User\Local Settings\Temp\ and/or it's not signed by a well-known software manufacturer,  I would definitely be suspicious as files named afile.exe have been known to be associated with re-directors to malware-hosting sites like infoblasters.com - see the Comodo analysis here for one example.

------------
MS Windows 32-bit Vista Home Premium SP2 * Firefox 27.0.1* IE 9.0 * NIS 2013 v. 20.4.0.40 * Process Explorer v. 16.01
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS


Viewing all articles
Browse latest Browse all 4287

Trending Articles