Windows 10: taskmngr.exe??

I downloaded build 10240 from an external source, in order to upgrade from the previous build of windows 10.
after it installed, bitdefender free detected and quarantined a file called taskmngr.exe in the system32 folder.
It never found such a file before.
A cursory search on the web revealed that this is not a windows file, and is highly suspicious, especially in said location.
but maybe windows 10 RTM is different?
anybody know something about this?
I then saw in windows task manager that this exe file was set to run at startup, but, strangely, it had a name in french: Gestionnaire des taches. That means "task manager" in french, according to Google.
Is this normal, or what?

:)

 

What external source did you download from?

are you sure its a genuine version, not a tampered with one

 

there is a certain well-known bay that has these kinds of torrents.
I don't know exactly how to check that it is genuine (maybe you could tell me how?), but the reader's comments seemed satisfied with the torrent, and malwarebytes found my system clean after install. (that is, after the said file was already quarantined by bitdefender)
I just mounted the ISO and had bitdefender scan it, and it came out clean.

 

That's your task manager, obviously a false positive(the main reason I use Defender and no 3rd party AV's)

 

you would think so, but it's not. my task manager works just fine, even after quarantining the file. It bears a name that sounds legit, but sources on the web say it is not a microsoft file, it's a fake.

 

You can upload the file to VirusTotal to see if it is dangerous.

 

did. results are 29 / 55
interestingly, among the results are
Microsoft Trojan:Win32/Skeeyah.A!bit I ran a program that generated the hash count of the ISO.
how can I verify it?

MD5 Checksum: A8FEE16A90B857E6B9993CC8A7E44FB9
SHA-1 Checksum: 2DAE26929E0E9F841AE4D53BF83705801263BDDB
SHA-256 Checksum: 934D475EA8FF17DDCEE99B4DD6027530534558D4ECE8701E2E82DD10203339CB
SHA-512 Checksum: 828B254D41D45EF4C742D165E612ACA43EB7BE001CBC61F9AB93D197D4EE4ECDF7E3C18B663FCEAB852F562F2AD2A9D0FCC0 E9B0C188FA38A8ED94FBCF119C85
Generated by MD5 & SHA Checksum Utility @ MD5 SHA Checksum Utility | Raymond's WordPress

 

It tells you how at the MD5 link you just posted:

I recommend though that VirusTotal link to keep bookmarked in all your browsers. It can check site links too if you are not sure about them*Nerd

 

Notice the name.. .his was TaskmNgr, while yours is Taskmgr.

 

I didn't get it. who had the name TaskmNgr?

 

Beating myself on the head... Thanks for bring it to my attention, scanning a paragraph isn't reading it.

 

right, but I need to get the true hash value for the genuine ISO, in order to compare. where is that info available?

 

I don't know, because, the original isn't an ISO, it came through Windows Update.

 

okay, so I restored the suspicious file, and then ran windows defender, and it removed it, too.

this particular torrent -- Windows 10 Pro RTM 10240 x64 ISO - TankityTank -- is bundled with an activator, for people who need it for whatever reason. So I surmise that the suspicious file was added to the ISO to facilitate the activator.
does that make sense to anyone?

 

You did. Look at the title of this thread.