none
Hashes on 2 Exchange 2010 exe files

    问题

  • Hi

    We are doubtful about 2 files with Exchange 2010 Hub/ CAS server. Below are the hashes of those files, can someone compare these values with any working Exchange 2010 Hub / CAS servers

    MSExchangeADTopologyService.exe
    SHA1 hash of file MSExchangeADTopologyService.exe: 29cb90c174b5dd6d7ab52318790a64857d584d66

    MSExchangeADTopologyService.exe
    MD5 hash of file MSExchangeADTopologyService.exe:a73bdc6c6f827546046c338711a2e1a3

    exfba.exe
    SHA1 hash of file exfba.exe: 873fe514bac66a134cb3b09acd4b531f0967b4c2

    exfba.exe
    MD5 hash of file exfba.exe: 04bc1e01a4c2f48129981237a62569c1

    Thanks in advance


    LMS

    2018年5月15日 8:21

全部回复

  • Do you have a question?

    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
    Celebrating 20 years of providing Exchange peer support!

    2018年5月15日 21:21
  • Hello Ed

    Our concern is whether these hashes are same when we compare with any working Exchange CAS / HUB servers. Because these processes showing in Capital Letters when we check running processes in the server (eg: Exchange Form Based Authentication for exfba.exe). There was a virus outbreak and all data got erased except these 2 servers. We did a thorough scan as well checked the files with Virus total and didn't find any issues, but just want to confirm it

    Thank You 


    LMS

    2018年5月16日 5:56
  • Hi LMS,

    Here is output in my Exchange 2010 SP3 UR20 labs:


    Best Regards,
    Niko Cheng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    2018年5月16日 8:51
    版主
  • Thank You

    I believe once we install any Exchange updates the files get updated and the hashes might change.

    One Q here. With the process viewer both the processes are showing in Capital Letters, how it's showing with you?


    LMS

    2018年5月18日 11:04
  • Hi LMS,

    Q: With the process viewer both the processes are showing in Capital Letters, how it's showing with you?

    A: Install KB2819745 to update powershell version to 4.0, then run "Get-FileHash " command in windows powershell.



    Best Regards,
    Niko Cheng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    2018年5月21日 1:55
    版主