dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
1184
share rss forum feed


The Penguin

join:2001-07-31
45 South

Setup.exe

Recently my pc became very slow and unresponsive with the hard drive working. I checked Task Manager and saw that something called 'setup.exe' in 'System' was taking up huge amounts of cpu/memory.
I was not installing or uninstalling anything at the time. I eventually rebooted to get my pc back to normal speed. Does anyone know what this would be and if it is a legit file, is it necessary?
Thanks for any advice.
--
Dances With Marmots


VikingBob

join:2004-06-05
Ste Anne, MB

1 edit
That could be pretty much anything, legit or not. There are plenty of different files out there called setup.exe... Do a search on your hard drives, and see what comes up. Submit to virustotal if you feel the need.

If you could have run Sysinternals Process Explorer while it was running, you could have found out where the file is/was located.


Juggernaut
Irreverent or irrelevant?
Premium
join:2006-09-05
Kelowna, BC
kudos:2
reply to The Penguin
End that process, and see how the computer reacts. If it restarts automagically, you may have a problem. Finding out what it is, is the first step.
--
I'm not anti-social, I just don't like stupid people.


The Penguin

join:2001-07-31
45 South
reply to The Penguin
Thanks for the replies VikingBob and Juggernaut.It hasn't kicked in again yet, but when/if it does I'll see if I can pin down where it's located. In the meantime I've run Malwarebytes and that found nothing.
--
Dances With Marmots


Snowy
Premium
join:2003-04-05
Kailua, HI
kudos:6
Reviews:
·Time Warner Cable
·Clearwire Wireless
said by The Penguin:

Thanks for the replies VikingBob and Juggernaut.It hasn't kicked in again yet, but when/if it does I'll see if I can pin down where it's located.

Something named "Setup.exe" would create folders/files you'd think.
I'd do a file search for all the folders/files created today (or whatever date the unknown process was seen) looking for something out of the norm.


The Penguin

join:2001-07-31
45 South
Did a search and found 'setup.exe' in...
C/Windows/System32
C/Windows/System32/Dll cache

Also several in C/Program files/Installshield Installation Information
(type: setup launcher)

As the 'user' in Task Manager when it was running was 'system' I'm picking it might have been the one in the system32 folder.
Its size is 22.5kb and type is 'Windows NT setup executable'
Can't think why it would run for no apparent reason though.
--
Dances With Marmots


Dustyn
Premium
join:2003-02-26
Ontario, CAN
kudos:11

2 recommendations

You could try uploading that individual file to VirusTotal?


Snowy
Premium
join:2003-04-05
Kailua, HI
kudos:6
Reviews:
·Time Warner Cable
·Clearwire Wireless
reply to The Penguin
said by The Penguin:

Did a search and found 'setup.exe' in...
C/Windows/System32
C/Windows/System32/Dll cache

You should upload it as Dustyn See Profile suggests.

*If* setup.exe was malware it may not be searchable after execution, so I'd actually pay more attention to any files or folders that were created.
Have you looked at event viewer for any entries that could explain it?


The Penguin

join:2001-07-31
45 South
reply to Dustyn
Ok. Just uploaded and no detections.
Looks like it may be a legit file, but now wondering if it is a necessary one if it 'freezes' the computer when running.
--
Dances With Marmots


The Penguin

join:2001-07-31
45 South
reply to Snowy
Just checked 'event viewer' system log and all 'system' user events are listed as either 'Service Control Manager' or a few as DCOM (source) 'error'.
--
Dances With Marmots


Snowy
Premium
join:2003-04-05
Kailua, HI
kudos:6
Reviews:
·Time Warner Cable
·Clearwire Wireless
reply to The Penguin
said by The Penguin:

Ok. Just uploaded and no detections.
Looks like it may be a legit file, but now wondering if it is a necessary one if it 'freezes' the computer when running.

Send it over to a sandbox for an analysis.
»www.threatexpert.com/submit.aspx


The Penguin

join:2001-07-31
45 South
Analysis: Something about host being Internet Systems Consortium?
Nothing else.
--
Dances With Marmots


norwegian
Premium
join:2005-02-15
Outback
kudos:1
It could have been a corrupted installer, poorly coded program etc, an endless loop because of it etc. Setup.exe is a standard installer file.

You need to monitor your task manger and the memory/cpu components of performance and also cpu and memory columns of the processes tab. Please use also (check box); view-select columns-select PID

If you can see something is high on usage and the networking tab shows high usage - and you are not downloading, you may need to run:
cmd (under admin)- type netstat -ano - the PID will match so we can link the IP addresses to the process. I can go into detail but with such limited info to start with, at least operating system etc to help be more specific in replies.
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke



ZZZZZZZ
Premium
join:2001-05-27
PARADISE
kudos:1
reply to The Penguin
»www.nirsoft.net/utils/computer_a···iew.html

Use this to see what triggered it or Windows cleanup utility,too.
--
Sarcasm is the body’s natural defense against stupidity.


The Penguin

join:2001-07-31
45 South
reply to The Penguin
Thanks for the advice. Setup.exe hasn't cut in again as yet but have d/loaded 'LastActivity' and will run it if it does. (and if I can!)

Windows XP
Firefox
--
Dances With Marmots


ZZZZZZZ
Premium
join:2001-05-27
PARADISE
kudos:1
It's a standalone app that doesn't need installing!


The Penguin

join:2001-07-31
45 South
But doesn't it need to be activated from its exe file when required? (When setup.exe was running, my pc 'froze' and I couldn't get to anything)
--
Dances With Marmots


ZZZZZZZ
Premium
join:2001-05-27
PARADISE
kudos:1
Just double click the program exe........if nothing happens then you've got other problems.
--
Sarcasm is the body’s natural defense against stupidity.