none
Hashes on 2 Exchange 2010 exe files

    问题

  • Hi

    We are doubtful about 2 files with Exchange 2010 Hub/ CAS server. Below are the hashes of those files, can someone compare these values with any working Exchange 2010 Hub / CAS servers

    MSExchangeADTopologyService.exe
    SHA1 hash of file MSExchangeADTopologyService.exe: 29cb90c174b5dd6d7ab52318790a64857d584d66

    MSExchangeADTopologyService.exe
    MD5 hash of file MSExchangeADTopologyService.exe:a73bdc6c6f827546046c338711a2e1a3

    exfba.exe
    SHA1 hash of file exfba.exe: 873fe514bac66a134cb3b09acd4b531f0967b4c2

    exfba.exe
    MD5 hash of file exfba.exe: 04bc1e01a4c2f48129981237a62569c1

    Thanks in advance


    LMS

    2018年5月15日 8:21

全部回复

  • Do you have a question?

    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
    Celebrating 20 years of providing Exchange peer support!

    2018年5月15日 21:21
  • Hello Ed

    Our concern is whether these hashes are same when we compare with any working Exchange CAS / HUB servers. Because these processes showing in Capital Letters when we check running processes in the server (eg: Exchange Form Based Authentication for exfba.exe). There was a virus outbreak and all data got erased except these 2 servers. We did a thorough scan as well checked the files with Virus total and didn't find any issues, but just want to confirm it

    Thank You 


    LMS

    2018年5月16日 5:56
  • Hi LMS,

    Here is output in my Exchange 2010 SP3 UR20 labs:


    Best Regards,
    Niko Cheng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    2018年5月16日 8:51
    版主
  • Thank You

    I believe once we install any Exchange updates the files get updated and the hashes might change.

    One Q here. With the process viewer both the processes are showing in Capital Letters, how it's showing with you?


    LMS

    2018年5月18日 11:04
  • Hi LMS,

    Q: With the process viewer both the processes are showing in Capital Letters, how it's showing with you?

    A: Install KB2819745 to update powershell version to 4.0, then run "Get-FileHash " command in windows powershell.



    Best Regards,
    Niko Cheng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    2018年5月21日 1:55
    版主
  • Hi LMS,

    I'm just writing to check how's everything going? If you have any questions or needed further help on this issue, please feel free to post back. If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well. Thanks for your understanding.


    Best Regards,
    Niko Cheng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    2018年5月29日 8:18
    版主