home

mdsync32.dll

IIS 4.0 Metadata Synchronizer

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The module mdsync32.dll, “IIS 4.0 Metadata Synchronizer” has been detected as a potentially unwanted program by 23 anti-malware scanners. It runs as a separate (within the context of its own process) windows Service named “IIS 4.0 Metadata Synchronizer”.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Microsoft® Windows® Operating System

Description:
IIS 4.0 Metadata Synchronizer

Version:
6.0.4.6

MD5:
eee4eb8da97b2c8a1432aa4fa73eb36c

SHA-1:
54cf1ddc0914a45e6b11c463de3c4765e06812bf

SHA-256:
259d76fd76cbc372d238616cfedccec11d211176d23fcde419196f3703b034d8

Scanner detections:
23 / 68

Status:
Potentially unwanted

Analysis date:
4/28/2024 6:38:03 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Crypt.GH.2
7.10.12.30

avast!
Win32:Globan
2014.9-170312

AVG
Proxy
2018.0.2442

Bitdefender
Trojan.Crypt.GH
1.0.20.355

Comodo Security
TrojWare.Win32.TrojanProxy.Glukerlira.~PKC
6199

Emsisoft Anti-Malware
Trojan-Dropper.Agent!IK
8.17.03.12.01

F-Prot
W32/Dorando.A.gen
v6.4.6.2.117

F-Secure
Trojan.Crypt.GH
11.2017-12-03_1

G Data
Trojan.Crypt.GH
17.3.21

IKARUS anti.virus
Trojan-Dropper.Agent
t3scan.1.1.88.0

K7 AntiVirus
Trojan
13.63.2608

Kaspersky
Trojan-Proxy.Win32.Glukelira
14.0.0.-1295

McAfee
Suspect-AB!EEE4EB8DA97B
5600.6098

Microsoft Security Essentials
TrojanProxy:Win32/Dorando.gen!A
1.163.1557.0

Norman
W32/Malware.JLTX
11.20170312

nProtect
Trojan/W32.Packer.11264.AG
10.09.25.01

Panda Antivirus
Trj/CI.A
17.03.12.01

Prevx
Medium Risk Malware
3.0

Quick Heal
TrojanProxy.Glukelira.pe
3.17.11.00

Rising Antivirus
Trojan.Spy.Win32.Undef.nd
23.00.65.17310

Sophos
Mal/Pukish-B
4.58

SUPERAntiSpyware
Adware.Vundo/Variant-MSFake
8541

Vba32 AntiVirus
BScope.Trojan-Dropper.Inject
3.12.14.1

File size:
11 KB (11,264 bytes)

Product version:
6.0.4.6

Copyright:
© Microsoft Corporation. All rights reserved.

File type:
Dynamic link library (Win32 DLL)

Language:
English (United States)

File PE Metadata
Compilation timestamp:
3/21/2009 1:48:35 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

Entry address:
0x9EE0

Entry point:
80, 7C, 24, 08, 01, 0F, 85, B9, 01, 00, 00, 60, BE, 00, 80, 00, 10, 8D, BE, 00, 90, FF, FF, 57, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB...
 
[+]

Code size:
12 KB (12,288 bytes)

Service
Display name:
IIS 4.0 Metadata Synchronizer

Service name:
mdsync32

Type:
Win32OwnProcess

Group:
Event Log


Remove mdsync32.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.