What is file "66d2.exe" from update?
|
|
Rebecca Proudhon
(TM)
Join date: 3 May 2006
Posts: 1,686
|
07-10-2007 03:58
When i downloaded the update today, at the end of the download I had a Windows Vista POP up asking me to ALLOW or CANCEL a file named 66d2.exe. This is not usual during a SL update for me. Is this a legitimate file? Why an .exe? i ran a VR and Pest Scan and nothing appeared. If I don"t allow the file the update fails. I don;t like the idea of strange .ex4e coming with the download. Everyone else with Vista see this?
|
|
Rebecca Proudhon
(TM)
Join date: 3 May 2006
Posts: 1,686
|
07-10-2007 09:54
Can anyone else using Vista, please confirm they also were asked to "Allow" this "662d.exe" when downloading this patch of last few days? Why would we have a new .exe file with an obscure filename like that?
|
|
Darien Caldwell
Registered User
Join date: 12 Oct 2006
Posts: 3,127
|
07-10-2007 12:15
It may have nothing to do with the update. I'd be careful as it sounds like you may have some type of infection.
|
|
Rebecca Proudhon
(TM)
Join date: 3 May 2006
Posts: 1,686
|
07-11-2007 04:00
From: Darien Caldwell It may have nothing to do with the update. I'd be careful as it sounds like you may have some type of infection. Not "allow"-ing it would cause the update to fail. Full scans showed nothing. First 2 times I did download of patch when I saw pop up I cancelled. Third time I allowed it and the patch completed. Full Virus/Pest scan shows no infection. But I do not like the whole thing. Any Vista user see or not see, this User Control Pop up during last patch couple days ago? to "allow" 66d2.exe" And why would there be a .exe, file with such an obscure filename at the end of the SL update?
|
|
Thili Playfair
Registered User
Join date: 18 Aug 2004
Posts: 2,417
|
07-11-2007 05:15
Used vista and update sl through it never saw that one ask/popup, i wont use update much tho, not much point ,the same size on download directly from page and some get issues with updater. Id delete that file from your pc, direct download from SL webpage instead, if it pops up again randomly that would be a spyware/trojan probably since the install dont have a file named like this, Could be any page that you visit that drops it on you (dont say you use iexplorer on vista n.n its horrible crap) check your prefetch folder, usually something like; C:\WINDOWS\Prefetch\66d2.exe-(stuffhere)-.pf , If its there, it will keep downloading/extracting itself without asking. Pretty unknown file tho, i know sl updater make a really odd filename when its updating and then you might get asked do you want to allow this?. Much faster way to update; http://secondlife.com/community/downloads.php
|
|
Rebecca Proudhon
(TM)
Join date: 3 May 2006
Posts: 1,686
|
07-11-2007 23:52
From: Thili Playfair Used vista and update sl through it never saw that one ask/popup, i wont use update much tho, not much point ,the same size on download directly from page and some get issues with updater. Id delete that file from your pc, direct download from SL webpage instead, if it pops up again randomly that would be a spyware/trojan probably since the install dont have a file named like this, Could be any page that you visit that drops it on you (dont say you use iexplorer on vista n.n its horrible crap) check your prefetch folder, usually something like; C:\WINDOWS\Prefetch\66d2.exe-(stuffhere)-.pf , If its there, it will keep downloading/extracting itself without asking. Pretty unknown file tho, i know sl updater make a really odd filename when its updating and then you might get asked do you want to allow this?. Much faster way to update; http://secondlife.com/community/downloads.php No. The file 66d2.exe is not anywhere on the machine nor in the prefetch folder. I checked that immediatly. It only repeat if I unistall and reinstall Sl. It is most likely a file coming from SL during the update and Vista's Security is so tight, that it is catching some shoddy and insecure programming. It is clearly an .exe, that ran at the end of the update. I have run all forms of scans on the machine and nothing turns up. There are no particular symptoms of anthing out of place. I just did the Sl update for today....and this time the filename triggering User Account Control, was "B200.exe" it appears to be the .exe which unpacks the file.
|
|
AWM Mars
Scarey Dude :¬)
Join date: 10 Apr 2004
Posts: 3,398
|
07-12-2007 06:59
Have you tried quarenting the file (asuming you can find it) although Windows does keep a log of all activities in the Administrative Services icon in control panel. That might give you a clue.
_____________________
*** Politeness is priceless when received, cost nothing to own or give, yet many cannot afford - Why do you only see typo's AFTER you have clicked submit? ** http://www.wba-advertising.com http://www.nex-core-mm.com http://www.eml-entertainments.com http://www.v-innovate.com
|
|
Rebecca Proudhon
(TM)
Join date: 3 May 2006
Posts: 1,686
|
07-12-2007 10:59
From: AWM Mars Have you tried quarenting the file (asuming you can find it) although Windows does keep a log of all activities in the Administrative Services icon in control panel. That might give you a clue. Once I run let it run the SL update unpacks. Afterwards the file itself has vanished cannot be found anywhere, not in any directory and no mention of it in the registry.
|
|
AWM Mars
Scarey Dude :¬)
Join date: 10 Apr 2004
Posts: 3,398
|
07-13-2007 03:37
From: Rebecca Proudhon Once I run let it run the SL update unpacks. Afterwards the file itself has vanished cannot be found anywhere, not in any directory and no mention of it in the registry. That would be a sign of good programming, whereby the installation programme cleans up after itself. You sure that came from LL? <sacasim mode on>
_____________________
*** Politeness is priceless when received, cost nothing to own or give, yet many cannot afford - Why do you only see typo's AFTER you have clicked submit? ** http://www.wba-advertising.com http://www.nex-core-mm.com http://www.eml-entertainments.com http://www.v-innovate.com
|
|
Rebecca Proudhon
(TM)
Join date: 3 May 2006
Posts: 1,686
|
07-13-2007 10:49
From: AWM Mars That would be a sign of good programming, whereby the installation programme cleans up after itself. You sure that came from LL? <sacasim mode on> Don't worry. it's not good enough, Were it "good" programming, it wouldn't have needed to trigger User Account Controls as an "unknown publisher" and leave me wondering, if LL was giving me a .exe keylogger with an obscure name or worse.
|
|
Johan Laurasia
Fully Rezzed
Join date: 31 Oct 2006
Posts: 1,394
|
07-13-2007 10:58
I searched the web for "66d2.exe" and absolutely nothing came up, generally, if it's some valid process, serveral links show up, or the same if it's a virus (or a virus masquarading as a valid process). Therefore, I think it's probably part of the SL installation, perhaps one of the mods can find out. If it is a virus or trojan, it's a really new one, but my guess is that it's part of the install.
|