home

Ghostsrv.exe

Symantec GhostCast Server

Symantec Corporation

This is installed with Symantec Ghost Standard Tools. The file has been seen being downloaded from download1459.mediafire.com and multiple other hosts.
Publisher:
Symantec Corporation  (signed and verified)

Product:
Symantec GhostCast Server

Description:
Symantec GhostCast Server for Windows

Version:
11.5.0.2113

MD5:
2e5269937387e54e4b058af0b78881ad

SHA-1:
fd118b168a932c259b2cc335aff6e76ee916a1ce

SHA-256:
41b08f12cfa7fe0281ddb1810abf6116ba7bfbd70190228a8bb251fcfb3447e2

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 7:24:03 AM UTC  (today)

File size:
621.4 KB (636,296 bytes)

Product version:
11.5.0.2113

Copyright:
Copyright (C) 1998-2008 Symantec Corporation. All rights reserved.

Original file name:
Ghostsrv.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\pebuilder3110a\plugin\ghost11.5\files\ghostsrv.exe

Digital Signature
Signed by:
Symantec Corporation

Authority:
VeriSign, Inc.

Valid from:
10/31/2007 1:00:00 PM

Valid to:
11/25/2010 12:59:59 PM

Subject:
CN=Symantec Corporation, OU=Symantec Research Labs, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Symantec Corporation, L=Santa Monica, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
758F5EE8263B6694719D8434EB998608

File PE Metadata
Compilation timestamp:
4/22/2008 9:07:28 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
6144:xnAHDkkXCzr0mmwn5jQKnVwpSqI1QxO3Ss1PnHIIUjz9KbRsniygd25SzA/Kd38s:xQY0/moSjmx0SsdHUapKSzA3S

Entry address:
0x4CF06

Entry point:
E8, 2F, EE, 00, 00, E9, 16, FE, FF, FF, 8B, 44, 24, 04, 33, C9, 3B, 04, CD, C8, 7E, 48, 00, 74, 12, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0C, 6A, 0D, 58, C3, 8B, 04, CD, CC, 7E, 48, 00, C3, 05, 44, FF, FF, FF, 6A, 0E, 59, 3B, C8, 1B, C0, 23, C1, 83, C0, 08, C3, E8, C8, 50, 00, 00, 85, C0, 75, 06, B8, 30, 80, 48, 00, C3, 83, C0, 08, C3, E8, B5, 50, 00, 00, 85, C0, 75, 06, B8, 34, 80, 48, 00, C3, 83, C0, 0C, C3, 56, E8, E7, FF, FF, FF, 8B, 4C, 24, 08, 51, 89, 08, E8, 8D, FF, FF, FF, 59, 8B, F0...
 
[+]

Entropy:
6.3205

Code size:
420 KB (430,080 bytes)

The file Ghostsrv.exe has been discovered within the following program.

Symantec Ghost Standard Tools  by Symantec Corporation
Publisher's description - “Symantec Ghost is the industry’s most widely-used deployment, system management, and computer imaging software solution. Use Ghost’s proven hardware-independent imaging capabilities to significantly accelerate day-to-day imaging and deployment needs.”
www.symantec.com
4% remove it
 
Powered by Should I Remove It?

The file Ghostsrv.exe has been seen being distributed by the following 3 URLs.

http://download1459.mediafire.com/rd6l749di6mg/.../GhostSrv.exe

http://download1979.mediafire.com/7s8b9ke4pkcg/.../GhostSrv.exe

http://download1255.mediafire.com/d4nllui83plg/.../GhostSrv.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.