Windows 10: {A6D608F0-0BDE-491A-97AE-5C4B05D86E01} virus?

Hello, I noticed this file {A6D608F0-0BDE-491A-97AE-5C4B05D86E01} in system32 folder and it keeps changing, I just don't know if it is a virus?

:)

 

AppLocker blocks .ps1 extention

Dear all. we successfully configured and implemented applocker for all domain users. But on some computers we observed some ps1 script tried to run but blocked by applocker. could you please tell me what kind of script are they?

%SYSTEM32%\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.BAT was prevented from running.

%OSDRIVE%\USERS\Userxxx\APPDATA\LOCAL\TEMP\SDIAG_EAE63D32-02A6-470D-A84A-E128799A30B8\NETWORKDIAGNOSTICSTROUBLESHOOT.PS1 was prevented from running.

Could these bat-s cause windows crash at startup? what are they? do i have to whitelist them?

 

Intel Graphics .bat file


Those with Intel Graphics probably already knew this, but it was news to me.

This is just an observation and I'm not recommending it ....

I don't use or want the Intel Hotkeys, Profiles, etc running, but not matter what I did the following 2 programs would always run on startup and show in Task Manager / Processes ... They are located in my c:\windows\system32 folder ...
igfxEM.exe
igfxHK.exe

Things I did with no success in getting them to not run at startup ...

1. Disabled Hotkey, Profiles, etc in the Intel HD Graphics Control Panel
2. Set the Intel Control Panel Service to Manual (I didn't want or try to disable it)
3. Double checked Services for them
4. Double checked Start Up for them
5. Double checked Task Scheduler for them
6. Double checked AutoRuns for them

What I found ...

In my c:\windows\system32 folder, I found the following bat file that is responsible for them running at startup. No clue what generates this bat file and could find very little info on it. Deleting, Editing, etc has no effect since it appears to be generated on startup ... So, the only way I found to stop them from running, is to rename those 2 programs.
igfxEM.exe.bak
igfxHK.exe.bak

{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
@Echo off
if exist igfxEM.exe start igfxEM.exe
if exist igfxHK.exe start igfxHK.exe
if exist igfxTray.exe start igfxTray.exe
del /Q {A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

Note: I've saw a few references to this bat file being located in c:\intel folder and it may have different random number name.
Note: Intel HD Graphics Control Panel still works from Control Panel and Right Click on the Desktop.

 

To save SDD space, can I delete rac.db?

Can I delete or otherwise reduce the size of the 1 GB database file rac.db:

C:\ProgramData\Microsoft\RAC\StateData\rac.db

This was Created ‎February ‎28, ‎2015, 1:18:26 PM - which was three months after I purchased and used the computer, making me suspect it may not be an essential Windows file.

File Explorer shows it as Modified yesterday.

The computer has Windows 8.1, 2 GB RAM and 20 GB SSD.

I don't know if "RAC" may stand for Reliability Analysis Custom Handler or Remote Assistance Contact. Some of the RAC files seem to relate to web browsing.

They may not have any connection to the above database, but according to File Explorer the following files were also created the same day:

1:33 PM:
C:\Windows\System32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat was created to run three Intel Graphics modules, which VirusTotal finds no problem with.

1:34 PM:
the folder "_hiddenPbk" was created with the empty Dial-up Remote Access phone book "rasphone.pbk" (0 bytes):
C:\Users\Max\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk

2:22 PM (then over the space of half an hour):
24 small Security catalog files of 10 to 48 KB each were created