Msiexec.exe

Discussion in 'malware problems & news' started by Dregg Heda, Feb 3, 2009.

Thread Status:
Not open for further replies.
  1. Dregg Heda

    Dregg Heda Registered Member

    Joined:
    Dec 13, 2008
    Posts:
    830
    Twice now while I have left my PC idle for an extended period of time OA free has had a pop-up informing me that msiexec.exe was attempting to create an API so that a program could autorun. The first time I think the PC was also connected to the net for an extended period of time. This time I am not so sure. Both times now I have hit block.

    Is this process trustable? It seems to be trusted in OA but could some other malicious software be using it to create the API? I just find it suspicious that it has popped up for no seeming reason. The only possibility is that it has something to do with the automatice updating of certain programs, but even so why would an API for a autorun(this is according to OA) need to be created. Any ideas? I just find it very spooky that this thing just pops-up for no seeming reason after the PC has been left idle for an extended period of time when it may have been connected to the net.

    Oh and for the record OA lists msiexec as a windows installer. What exactly is it supposed to install?
     
    Dregg Heda, Feb 3, 2009
    #1
  2. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    98,077
    Location:
    U.S.A.
    Here's a good explanation on msiexec.exe (Microsoft Installer) - Details. This process should not be running all the time, unless malware is trying to install itself. Use Process Monitor to see if this process is running in real time. You can also analyze that .exe with either Jotti's malware scan or VirusTotal.

    If that .exe is not running now, depending on your OS, review How to view and manage event logs in Event Viewer in Windows XP or Open Vista's Event Viewer to see past event logs for clues.
     
    JRViejo, Feb 3, 2009
    #2
  3. Dregg Heda

    Dregg Heda Registered Member

    Joined:
    Dec 13, 2008
    Posts:
    830
    Can I use winpatrol instead of process monitor?

    Also im worried that even if msiexec.exe is clean something else might be controling it and using it to create the api.
     
    Last edited: Feb 4, 2009
    Dregg Heda, Feb 4, 2009
    #3
  4. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    98,077
    Location:
    U.S.A.
    I'm not familiar with WinPatrol, however, the beauty of Process Monitor is that it does not install in your PC. You download it, unzip it and click on the Procmon.exe and on it goes.
     
    JRViejo, Feb 4, 2009
    #4
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...