1

I am trying to find out why this process appeared during 2 boot occasions. Autoruns does not show it anywhere. It appeared when I uninstalled google chrome and malwarebytes. The prefetch file for makecab.exe (makecab is an official microsoft process) showed it was created yesterday, and modified today (it ran once today and yesterday very briefly - no more than 10 seconds at boot. I've uninstalled the 2 programs before at the same time in the past multiple times, and have never seen this pb.exerocess. However, usually I delete EVERY file associated with those programs including registry when I did uninstall them.

Is there any reason why makecab.exe would run? I've used process explorer, but the process starts and ends too quickly for me to see what starts it. However, its only twice I've seen it appear, and thats after uninstalling chrome and mbam, both times I did not have process explorer ready.

Should I be worried about this? Or has it a legit reason for running?

I've noticed it begins around the same time as the windows module installer (comparing prefetch file to event viewer).

I haven't added any programs; I only saw this after uninstalling these programs, but as I said I usually delete the files manually. I've uploaded the versions of makecab onto virustotal and they're all clean.

I couldn't find anything in the registry other than a value which listed various system processes, however exporting it as a text file shows it hasn't been edited for years.

How can I find out what is starting it? I've rebooted various times with process explorer and nothing happened, I installed malwarebytes to scan, I did a full scan and found nothing, and installed chrome again. After the scan, I uninstalled the 2, and then while NOT using process explorer, but the normal task manager, I saw it again after I rebooted.

Is there a way I can make process explorer extend the time it shows killed processes?

  • i think it removes the remnants of the .msi install package. anyone here that thinks this is wrong? – H3lp3ingth3p33ps Jul 23 '14 at 11:54
  • Is that the case? Are you familiar with the process? Do cabinet files play a role in uninstalling programs? – Keyes Jul 23 '14 at 14:53
1

We cannot help you if you don't post more info about the file.

  1. First you will need the md5 signature of that file. You can use a tiny tool called winmd5 for that.
  2. Secondly either search that md5 sig online and try to find relevant information about the process/file or submit it to md5 malware databases such: https://isc.sans.edu/tools/hashsearch.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.