1

I downloaded MongoDB 3.4 from the MongoDB website here

When I run the .msi file to install, I am prompted with the following screen asking me if I trust a39adfe.msi

A Google search for a39adfe.msi turns up nothing.

Does anyone know if this is something expected and if not, why would it happen?

MongoDB permission for a39adfe.msi

Improve this question
5
  • Well the original filename appers only on the official site of mongoDB where you say you downloaded it. So this seems legit to me. Do you have any reason to believe that you were the target of an attack?
    – Tom K.
    Commented Feb 16, 2018 at 13:03
  • So what is a39adfe.msi?
    – CodyBugstein
    Commented Feb 16, 2018 at 13:51
  • More info on .msi here. a39adfe is probably a name of a package that is part of the installer. If you are still unsure, download the installer from another source and compare the md5 hashes.
    – Tom K.
    Commented Feb 16, 2018 at 14:01
  • @TomK. As MD5 is easy to create collisions with, it would be possible for MongoDB's developers to release a legitimate version of the software, and an evil version, both with the same MD5.
    – forest
    Commented Feb 23, 2018 at 6:16
  • @forest The MSI has a digital signature which should be significantly stronger reassurance than MD5, but the general approach of checksums can be also used with a more robust algorithm like SHA-256. The certificate can be verified via the UAC prompt ("Show information about the publisher's certificate") or via signtool.exe. There's a relevant DOCS improvement in the MongoDB issue tracker showing how to use signtool to verify the certificate and a SHA-256 hash of the installer: DOCS-10909: Windows signed MSI package verification steps.
    – Stennie
    Commented Feb 23, 2018 at 9:23

1 Answer 1

Reset to default
4

This is expected behaviour. When you install an MSI package, Windows caches a copy of the installer in "%windir%\installer" (a hidden system folder) and renames it using a random hex name. You can delve into the Windows registry to divine the mapping between original installer and the cached version, but if you'd like extra assurance it is probably easier (and more definitive) to compare the two .msi files.

Aside from the filename, the cached .msi file should be the same as the original .msi: you could compare details like file size, signing information, and checksums. In your screenshot, the verified publisher is "MongoDB, Inc".

You can confirm the install behaviour using:

 msiexec.exe /i <path_to_MSI> /lfvmous output.txt

Example output:

MSI (s) (14:A8) [14:00:05:398]: Original package ==> C:\Users\User\Desktop\mongodb-win32-x86_64-2008plus-ssl-3.4.13-signed.msi

MSI (s) (14:A8) [14:00:05:398]: Package we're running from ==> C:\WINDOWS\Installer\2c8ddfd2.msi

For some related information, see: Where the MSI file is copied after the installation?.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .