I downloaded build 10240 from an external source, in order to upgrade from the previous build of windows 10.
after it installed, bitdefender free detected and quarantined a file called taskmngr.exe in the system32 folder.
It never found such a file before.
A cursory search on the web revealed that this is not a windows file, and is highly suspicious, especially in said location.
but maybe windows 10 RTM is different?
anybody know something about this?
I then saw in windows task manager that this exe file was set to run at startup, but, strangely, it had a name in french: Gestionnaire des taches. That means "task manager" in french, according to Google.
Is this normal, or what?
What external source did you download from?
are you sure its a genuine version, not a tampered with one
there is a certain well-known bay that has these kinds of torrents.
I don't know exactly how to check that it is genuine (maybe you could tell me how?), but the reader's comments seemed satisfied with the torrent, and malwarebytes found my system clean after install. (that is, after the said file was already quarantined by bitdefender)
I just mounted the ISO and had bitdefender scan it, and it came out clean.
That's your task manager, obviously a false positive(the main reason I use Defender and no 3rd party AV's)
you would think so, but it's not. my task manager works just fine, even after quarantining the file. It bears a name that sounds legit, but sources on the web say it is not a microsoft file, it's a fake.
You can upload the file to VirusTotal to see if it is dangerous.
did. results are 29 / 55
interestingly, among the results areI ran a program that generated the hash count of the ISO.
Microsoft Trojan:Win32/Skeeyah.A!bit
how can I verify it?
MD5 Checksum: A8FEE16A90B857E6B9993CC8A7E44FB9
SHA-1 Checksum: 2DAE26929E0E9F841AE4D53BF83705801263BDDB
SHA-256 Checksum: 934D475EA8FF17DDCEE99B4DD6027530534558D4ECE8701E2E82DD10203339CB
SHA-512 Checksum: 828B254D41D45EF4C742D165E612ACA43EB7BE001CBC61F9AB93D197D4EE4ECDF7E3C18B663FCEAB852F562F2AD2A9D0FCC0 E9B0C188FA38A8ED94FBCF119C85
Generated by MD5 & SHA Checksum Utility @ MD5 SHA Checksum Utility | Raymond's WordPress
It tells you how at the MD5 link you just posted:I recommend though that VirusTotal link to keep bookmarked in all your browsers. It can check site links too if you are not sure about themInstruction to Verify hash
- Download a software that provides MD5, SHA-1 & SHA-256 hash
- Copy one of the hashes to clipboard (Ctrl + C)
- Drag and drop the downloaded file into the program or use the Browse button to select the downloaded file
- Selected hashes will be generated
- Click on the Paste button
- Click on the Verify button and the result will be displayed in a message box
You can try generate hash for this software and verify with one of the checksum below.
Checksums for MD5 & SHA Checksum Utility 2.1 (Free)
MD5 Checksum:2D423B85E6684956B817E6C7E36BE3DC
SHA-1 Checksum:4B70B5213249014C3785460720B81B5F9BEABEC3
SHA-256 Checksum: D3D6F3597AEBA37312F61E59BA465E57B19140CC9A4517C7F9C49461F1D0A4BB
SHA-512 Checksum: 53914AFA0E66C50BBD12D9FFB7833FD5094FA10735D8700BFF9CD87C2A7EB478D6715B34EAE4F53652F0E48EC3526C51C431 C08ACF4EC70E8DD5FCD5FA84C129
Notice the name.. .his was TaskmNgr, while yours is Taskmgr.
I didn't get it. who had the name TaskmNgr?
![taskmngr.exe?? taskmngr.exe??](https://4.bp.blogspot.com/-TLdMzjkQzP0/WBofuNFBGJI/AAAAAAAAAAM/EuCR96Cm0OcQK0gbbjiOENSkqtEy6dExgCLcB/s640/image.jpg)