Windows 10: Strange exe and dll that runs a console window on my pc when it starts

Hello Everyone,


I found this odd file in my C:\Users\[User Account Name]\AppData\Roaming\Microsoft\gdtsgheb


It has 2 files a dll and an executable. It runs on my computer every time in a terminal but it is too fast to see the file location but this time it froze for a few seconds and I could see the location. I did a virus total for both files and there are 0 detections


Below is a photo of what it looks like:



Is this safe to remove?

:)

 

When does the Operating system verify the Authenticode Signatures for signed EXEs and signed DLLs?

When PE Files (exes, dlls etc.) are code signed using signtool, they can be verified to check if they have been authored by trusted publishers. In which scenarios does the Operating system actually verify signed EXEs and DLLs?

1. Are signatures of EXEs verified every time they are run?
2. If an EXE has a dynamically linked DLL, is the DLL's signature verified when the EXE is run?
   
3. If the EXE dynamically loads a DLL using LoadLibrary, is the DLL's signature verified when the EXE is run?
4. When an EXE requires elevated privilege (UAC), is the signature of the EXE and the DLL dependencies verified as well? (1-3)

If this questions belongs in a different category or community, please let me know. Thanks.

 

Can't run .exe file

Hi Phil,

There are several reasons why you are having issues running .exe files on your Windows 10 laptop. To assist you better, kindly answer the questions below:

• Have you made any changes to your laptop prior to this issue?
• What troubleshooting steps have you done so far?
• What is the error message that you received when running .exe files?

Regards.

 

we couldn't complete the update kb3135173

Hello,

I'm sorry to inform you that your method 2 was unsuccessful.

For printer problem, I already contact HP but it seems that I need to make sure windows update work first.

Back to Method 2, are you sure this method also work for windows 10?

Anyway, I follow those steps and these what I encounter:

• net stop appidsvc: cmd "Application identity service is not started"
• net stop cryptsvc: There was a y/n question. My replay was Y.
• Step 4. In the first tried, I skip the 4th step.
• Step 6. There are several dll that either "failed to load" or "loaded but "entry point DllRegisterServer was not found". I didn't read all the error message, but this are dll that show error message:

• regsvr32.exe mshtml.dll
• regsvr32.exe shdocvw.dll
• regsvr32.exe browseui.dll
• regsvr32.exe msxml.dll
• regsvr32.exe gpkcsp.dll
• regsvr32.exe sccbase.dll
• regsvr32.exe slbcsp.dll
• regsvr32.exe initpki.dll
• regsvr32.exe wuaueng.dll
• regsvr32.exe wuaueng1.dll
• regsvr32.exe wucltui.dll
• regsvr32.exe wuweb.dll
• regsvr32.exe qmgr.dll
• regsvr32.exe qmgrprxy.dll
• regsvr32.exe wucltux.dll
• regsvr32.exe muweb.dll
• regsvr32.exe wuwebv.dll

• Step 10 i skip this.
• Are you sure step 11 need to be avoided and not step 10?
• I restart my computer, run windows update, no luck. Try those steps again with step 4 included.
• step 4.a. Ren %systemroot%\system32\catroot2 catroot2.bak
  "access denied".
• for step 6, still the same.
• Restart, no luck.

Now, what should I do?

By the way: I already uninstall HP printer driver, but strange enough windows update still show that there are update for the printer. Tried to install, error though.