Guide

How to check executable path and digital signature

Find di real file wey dey run, check who sign am and di version, and keep di signature evidence separate from malware verdict.

Identify di exact file

Start from di process wey dey run for Task Manager and open im file location or properties. Record di full path, executable name and version. Filenames wey resemble each oda fit belong to products wey no relate, and different installations of one product fit legitimately use different directories. If di process don close, make you separate di file on disk from di earlier process instance.

Compare di program with im installation source and publisher documentation. Product name inside file description na metadata wey pesin fit edit. Filename alone no fit prove say process dey safe.

Inspect di digital signature

Where Windows show Digital Signatures tab, inspect who sign am and di signature details. Some Windows files dey use catalog signing instead of embedded signature, so make di tab no dey no mean say na malware for sure. Compare who sign am with di publisher wey you dey expect, while you keep mind open for documented company or certificate changes.

Microsoft Sysinternals Sigcheck dey report version, hash and signature information, including certificate chains. Use di official download and inspect di command help. Local check like sigcheck -h -i wey full file path follow inside quotes dey inspect di file wey you pick. Keep di exact hash when you dey compare evidence about dat version.

Understand wetin di evidence mean

Valid signature dey support publisher identity and integrity for signed content. E no guarantee say di software suitable, free from bug or harmless. File wey no get signature fit be legitimate internal tool. Signature wey no valid fit mean say dem don modify am or e get verification wahala wey need investigation. Take all dis ones as evidence to resolve instead of automatic verdicts.

Online reputation na separate step. Sigcheck get options wey connect to VirusTotal, and some of dem fit submit files. No upload confidential executables or documents without permission. Local signature inspection no need public file upload.

Choose di next step from di evidence

If di path, who sign am or where di installation come from dey unexpected, avoid to launch di file again. Use Windows Security or your organization security tools and keep di relevant evidence. Use di product supported uninstall procedure when removal make sense.

No delete Windows system binary just because im name show for search result or because one resource sample look high. If you need help, provide di exact path, signer status, file version, hash and di symptom wey you see. Remove personal details before you share logs.

Sources

Editorial ownership: Feex. No independent review date dey recorded. How we dey do research.

Microsoft Sysinternals: Sigcheck · Primary documentation. The diagnostic sequence na Feex editorial guidance; e no be measured diagnosis of your PC.
Microsoft Sysinternals: Process Explorer · Primary documentation. The diagnostic sequence na Feex editorial guidance; e no be measured diagnosis of your PC.

This guide useful for you?

Yes or no dey enough. Choose reason if you want, or add short note.