Link to home
Start Free TrialLog in
Avatar of wfcrr
wfcrrFlag for United States of America

asked on

CDSUpdate.exe....what is that?

One of our Windows 10 Pro machine when restarted, immediately after logging on there is a CDSUpdate.exe that tries to run.  What is that?  I scanned the computer using Malwarebytes and it finds no threats.  When I Google CDSUpdate.exe I get some sketchy sites, but cannot find anything about what it is.

Avatar of David Johnson, CD
David Johnson, CD
Flag of Canada image

get sysinternals autoruns and find this file.. it is not a normal part of windows.

Avatar of wfcrr

ASKER

Thanks for sending that. I ran Autoruns and looked at everything it found, but I don't see that CDSUpdate.exe.

can it be a coolpad update ?  Coolpad CDS.exe - Download (updatestar.com) 

Avatar of ☠ MASQ ☠
☠ MASQ ☠

It's also the legitimate executable name for Ford's vehicle Body Control Module (BCM)  Company Data Systems updater which, if installed will be at C:\FordBCM\CDSUpdate\ .


How does it present?

On reboot are you seeing a window open saying it failed to load?

If so search for it in your Registry (RegEdit > Search (F3))

It's likely to have been added to your RunAtStart list but if it is malicious it will have already been quarantined or deleted so Windows and Autoruns no longer see the file.

Avatar of wfcrr

ASKER

cmd.jpgCDSUpdate - Unknown.jpg


Thanks, MASQ.  Interesting about the Ford BCM.  I wonder if they are spoofing with that?  I don't think there would be a Ford program on it, this is a machine that is only used in the office.  


I attached two pics I took from a video I shot as soon the desktop came up.  There isn't anything displayed in the cmd window.  The next thing that pops up is this window asking for admin and password to install it.

what about my suggestion?

Avatar of wfcrr

ASKER

Hi Nobus, I apologize for not responding. I don't think it is a coolpad update. We don't have a coolpad.  This computer is not connected to anything but the network.  It has TRAMS installed and Worldspan installed, and Office 2019 and that is all it is used for, checking email, running TRAMS and Worldspan. 

ASKER CERTIFIED SOLUTION
Avatar of David Johnson, CD
David Johnson, CD
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of wfcrr

ASKER

@ David Johnson...thanks, that was helpful.  I didn't think to click "Show more detail".  Turns out it is a Worldspan update.