guy12 Posted January 30, 2019 ID:1295633 Share Posted January 30, 2019 The file iastorlaunch.exe was detected as unsigned. Is this normal? It's suppossed to be from Intel. Link to post Share on other sites More sharing options...
kevinf80 Posted January 30, 2019 ID:1295652 Share Posted January 30, 2019 Hello guy12 and welcome to Malwarebytes, Is the spelling correct for the file you quote iastorlaunch.exe there are no hits on Google which would not be expected if it was connected to Intel... https://www.google.com/search?client=firefox-b&q=iastorlaunch.exe Thank you, Kevin... Link to post Share on other sites More sharing options...
guy12 Posted January 30, 2019 Author ID:1295653 Share Posted January 30, 2019 IAStorIconLaunch.exe, my bad Link to post Share on other sites More sharing options...
kevinf80 Posted January 30, 2019 ID:1295655 Share Posted January 30, 2019 Yes that one gets plenty hits, as the file is unsigned maybe is worthwhile uploading to VirusTotal to be analysed... Go to http://www.virustotal.com/ Click the Choose file button Navigate to the file in question Click the Scan it tab If you get a message saying File has already been analyzed: click Reanalyze file now Copy and paste the URL address back here please. Thanks, Kevin Link to post Share on other sites More sharing options...
guy12 Posted January 30, 2019 Author ID:1295657 Share Posted January 30, 2019 It found nothing, my question however is, is the file suppossed to be unsigned? Could someone check whether theirs is? Link to post Share on other sites More sharing options...
kevinf80 Posted January 30, 2019 ID:1295665 Share Posted January 30, 2019 The explanation at this link indicates it should be signed.... https://www.file.net/process/iastoriconlaunch.exe.html Link to post Share on other sites More sharing options...
guy12 Posted January 30, 2019 Author ID:1295666 Share Posted January 30, 2019 Yeah that's why I'm worried Link to post Share on other sites More sharing options...
kevinf80 Posted January 30, 2019 ID:1295670 Share Posted January 30, 2019 How do you know the file is unsigned...? Link to post Share on other sites More sharing options...
guy12 Posted January 30, 2019 Author ID:1295674 Share Posted January 30, 2019 Right click and properties. There is no digital signature tab unlike the other exe files. Link to post Share on other sites More sharing options...
David H. Lipman Posted January 30, 2019 ID:1295675 Share Posted January 30, 2019 Note. Any file can be named anything. What is the URL of the Virus Total Report requested in Post #4 ? You can submit this as a malicious suspect in; Newest Malware Threats referencing the following on how to provide sample submissions. Malware Hunters groupPurpose of this forum Link to post Share on other sites More sharing options...
guy12 Posted January 30, 2019 Author ID:1295678 Share Posted January 30, 2019 https://www.virustotal.com/#/file/99b7ca31d8e7679c45203d2287db6f13b669c95abeb2e2f0ae7290dcf84f273e/detection Link to post Share on other sites More sharing options...
kevinf80 Posted January 30, 2019 ID:1295686 Share Posted January 30, 2019 Hello again guy12, Is worthwhile following @David H. Lipman advice and upload the file in question for analysis, I do not have that file on my system for comparison.. Thank you, Kevin.. Link to post Share on other sites More sharing options...
kevinf80 Posted January 30, 2019 ID:1295692 Share Posted January 30, 2019 Hello again guy12, Try this first..... Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.htmlNote: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status... Run FRST then continue with the following: Type the following in the edit box after "Search:".IAStorIconLaunch.exe Click Search Files button and post the log (Search.txt) it makes to your reply. Thanks, Kevin... Link to post Share on other sites More sharing options...
exile360 Posted January 31, 2019 ID:1295790 Share Posted January 31, 2019 Just FYI, I too have Intel Rapid Storage installed and have a file by the same name and mine isn't signed either. Here's the VT scan of my copy (Windows 7 x64 SP1): https://www.virustotal.com/#/file/36725d37b2aa2d3aeebedc2af48c42e0b7b42ada66357c88d6c892d44db453d4/detection The version of IRST I have installed is 15.9.0.1015 from November 2017. The installer is digitally signed, the executable mentioned by the OP is not. There appears to be at least one version newer from Intel, but they don't offer it directly on their site and require you to either use their driver updater tool or to try Windows Update (they don't want people patching drivers with their generic ones and prefer users go to their OEM's/system manufacturers for customized drivers; unfortunately most OEM's are pretty bad about patching drivers, especially for legacy models/systems). Link to post Share on other sites More sharing options...
guy12 Posted January 31, 2019 Author ID:1295941 Share Posted January 31, 2019 Thanks, that was the answer I needed. Link to post Share on other sites More sharing options...
exile360 Posted January 31, 2019 ID:1295958 Share Posted January 31, 2019 You're welcome It is weird. They signed all their other executables in that folder, but not that one for whatever reason. My guess is that it was probably just an oversight. It isn't the first time I've noticed an issue with Intel's digital signing practices lately; in one of their recent chipset INF utility updates, all of the dates on their digital signatures/driver INF files were wonky, showing dates from the pre-20th century (like the 1500's, 1600's and 1700's) which really threw Windows for a loop as to determining the most recent INF for each component. It took me forever to get that issue sorted, but thankfully the chipset INF's aren't too important anyway since they're really only identifiers for the hardware, not actual drivers that determine functionality (they just update how the devices are identified in Device Manager by name/description etc.). Link to post Share on other sites More sharing options...
exile360 Posted January 31, 2019 ID:1295960 Share Posted January 31, 2019 By the way, I just double checked to make absolutely certain by extracting the original digitally signed IRST installer from Intel (thanks to UniExtract; very handy tool, highly recommended ), and sure enough, that file is not digitally signed out of the box so my IRST installation has not been tampered with; Intel just didn't sign that file when they compiled the installer. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now