Should I block it?

90%

90% of PCs block this file from running.

Possible reason:

Multiple malware detections

Additional versions

1.14.20.8091	42.86%
1.14.20.8091	57.14%

(Note, 337 Technology Limited publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Child process

desk365.exe (Desk 365 by 337 Technology Limited)

Related files

PE file structure

Show functions

Import table

advapi32.dll

DuplicateTokenEx, RegEnumKeyW, ControlService, ReportEventW, QueryServiceStatusEx, SetServiceStatus, ChangeServiceConfigW, StartServiceW, ChangeServiceConfig2W, DeregisterEventSource, RegisterServiceCtrlHandlerExW, OpenServiceW, EnumDependentServicesW, StartServiceCtrlDispatcherW, OpenSCManagerW, DeleteService, CloseServiceHandle, RegisterEventSourceW, CreateServiceW, SetTokenInformation, ConvertStringSidToSidW, GetTokenInformation, CreateProcessAsUserW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenCurrentUser, RegOpenUserClassesRoot, RevertToSelf, ImpersonateLoggedOnUser, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegCreateKeyW, RegSetValueExW, RegQueryValueExW, RegCloseKey, RegOpenKeyExW

kernel32.dll

UnhandledExceptionFilter, WaitForSingleObject, SetEvent, Sleep, CloseHandle, GetLastError, LoadResource, LockResource, SizeofResource, FindResourceW, FindResourceExW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetVersionExW, GetCurrentProcess, CreateFileW, CreateThread, ReadFile, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, CreateMutexW, ReleaseMutex, ConnectNamedPipe, DisconnectNamedPipe, CreateNamedPipeW, WriteFile, GlobalMemoryStatusEx, OpenProcess, SetProcessWorkingSetSize, ExitThread, WaitForMultipleObjects, TerminateProcess, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, SetPriorityClass, CreateEventW, TerminateThread, LocalFree, LoadLibraryW, SetUnhandledExceptionFilter, GetSystemInfo, GetSystemDefaultLangID, GetLogicalDriveStringsW, QueryDosDeviceW, GetSystemDirectoryW, GetSystemWindowsDirectoryW, ProcessIdToSessionId, GetEnvironmentVariableW, GetFileSize, FreeLibrary, GetProcessTimes, WideCharToMultiByte, GetFileAttributesW, MultiByteToWideChar, GlobalFree, LocalAlloc, SetFileAttributesW, GlobalAlloc, DeviceIoControl, GetVolumeInformationW, GetQueuedCompletionStatus, InitializeCriticalSectionAndSpinCount, RaiseException, InterlockedExchange, ResetEvent, GetExitCodeThread, PostQueuedCompletionStatus, CreateIoCompletionPort, GetCurrentThreadId, DeleteFileW, OutputDebugStringW, GetTickCount, GetProcessHeap, SetThreadPriority, HeapAlloc, HeapFree, GetPrivateProfileStringW, CopyFileW, GetPrivateProfileIntW, InterlockedDecrement, LCMapStringW, RtlUnwind, GetCPInfo, IsDebuggerPresent, IsProcessorFeaturePresent, ExitProcess, GetStdHandle, HeapCreate, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, SetHandleCount, GetFileType, GetConsoleCP, GetConsoleMode, DecodePointer, SetFilePointer, FlushFileBuffers, GetLocaleInfoW, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetCurrentProcessId, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, WriteConsoleW, SetStdHandle, CreateFileA, SetEndOfFile, EncodePointer, GetStringTypeW, InterlockedCompareExchange, lstrcmpiW, GetSystemTimeAsFileTime, GetStartupInfoW, HeapSetInformation, GetCommandLineW, HeapSize, HeapReAlloc, HeapDestroy, lstrlenA, InterlockedIncrement

ole32.dll

CoInitializeEx, CoInitializeSecurity, CoSetProxyBlanket, CoInitialize, CoUninitialize, CoCreateInstance

psapi.dll

EmptyWorkingSet, EnumProcesses, EnumProcessModules, GetProcessMemoryInfo, GetModuleFileNameExW

rpcrt4.dll

UuidFromStringW

sensapi.dll

IsNetworkAlive

shell32.dll

SHGetFolderPathW, SHGetSpecialFolderPathW

shlwapi.dll

PathRemoveFileSpecW, PathFileExistsW, PathCanonicalizeW, PathAppendW, SHGetValueW, PathCombineW

sqlite3.dll

sqlite3_busy_timeout, sqlite3_errmsg, sqlite3_column_text, sqlite3_column_count, sqlite3_open, sqlite3_close, sqlite3_column_name, sqlite3_column_type, sqlite3_prepare, sqlite3_reset, sqlite3_free, sqlite3_finalize, sqlite3_step, sqlite3_mprintf

user32.dll

wsprintfW, GetSystemMetrics

userenv.dll

DestroyEnvironmentBlock, CreateEnvironmentBlock

version.dll

VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW

winhttp.dll

WinHttpOpen, WinHttpAddRequestHeaders, WinHttpCrackUrl, WinHttpGetProxyForUrl, WinHttpReadData, WinHttpQueryDataAvailable, WinHttpOpenRequest, WinHttpQueryHeaders, WinHttpCloseHandle, WinHttpReceiveResponse, WinHttpSetTimeouts, WinHttpSetOption, WinHttpGetIEProxyConfigForCurrentUser, WinHttpSendRequest, WinHttpConnect, WinHttpWriteData

wininet.dll

InternetCheckConnectionW

desksvc.exe

dsk service by 337 Technology Limited (Signed)

Remove desksvc.exe

Version:	1.14.20.8091
MD5:	b8866e1e98908969d1ec287a61847f84
SHA1:	682f916f1c2c58133af729ea874253a9a353156e
SHA256:	b463767b4082f6baf6f0c7b0935c9eead2f15fbb7a62b2968cbedd677ccc39a9

Warning 6 antivirus scanners has detected malware.

Overview

desksvc.exe is malware that runs as a service under the name Desk 365 service (desksvc) within the local user context. It is installed with a couple of know programs including Desk 365 published by 337 Technology Limited, Desk 365 from 337 Technology Limited and Desk 365 by 337 Technology Limited. The file is digitally signed by 337 Technology Limited which was issued by the GlobalSign nv-sa certificate authority (CA).

Details

File name:	desksvc.exe
Publisher:	337 Technology Limited.
Product name:	dsk service
Typical file path:	C:\Program Files\desk 365\desksvc.exe
Original name:	dsk service.exe
File version:	1.14.20.8091
Size:	414.08 KB (424,016 bytes)
Build date:	9/2/2013 8:07 AM
Certificate
Issued to:	337 Technology Limited
Authority (CA):	GlobalSign nv-sa
Effective date:	Monday, June 25, 2012
Expiration date:	Friday, June 26, 2015
Digital DNA
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

Desk 365

337 Technology Limited

60% remove

“Desk 365 offers you the fastest and easiest way to manage your desktop shortcuts and kinds of applications. With Desk 365's powerful capabilities, you can access your software and applications instantly. You can also keep your desktop tidy and clean! Desk 365 has a user friendly interface, is easy and safe to use, and simple to install.Experience the new generation of Desktop mangager - download Desk 365 now. You can easily cusomize the...”

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'desksvc' (Desk 365 service)
desksvc

Malware detections

Based on 40+ industry antivirus scanners, 6 of them detected the following malware.

Antivirus engine	Engine version	Detection
Comodo Internet Security	17029	ApplicUnwnt
Ikarus	T3.1.5.4.0	not-a-virus:AdWare.Win32.D365
Kaspersky	9.0.0.837	not-a-virus:AdWare.Win32.D365.a
Kingsoft	2013.4.9.267	Win32.Troj.D365.a.(kcloud)
Trend Micro HouseCall	9.700.0.1001	TROJ_GEN.F47V0904
Vba32 AntiVirus	3.12.24.3	AdWare.D365

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00219741%	0.028634%
Kernel CPU:	0.00189444%	0.013761%
User CPU:	0.00030297%	0.014873%
Kernel CPU time:	390,057 ms/min	100,923,805ms/min
Memory
Private memory:	3.84 MB	21.59 MB
Private (maximum):	10.28 MB
Private (minimum):	5.01 MB
Non-paged memory:	3.84 MB	21.59 MB
Virtual memory:	80.49 MB	140.96 MB
Virtual memory (peak):	86.33 MB	169.69 MB
Working set:	5.31 MB	18.61 MB
Working set (peak):	10.33 MB	37.95 MB
Resource allocations
Threads:	18	12
Handles:	279	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	"C:\Program Files\desk 365\desksvc.exe"
Owner:	User
Windows Service
Service name:	desksvc
Display name:	Desk 365 service
Description:	“Desk 365 service”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads

Averages

deskSvc.exe (main module)
Total CPU:	0.00168993%	0.272967%
Kernel CPU:	0.00168993%	0.107585%
User CPU:	0.00000000%	0.165382%
CPU cycles:	38,198/sec	5,741,424/sec
Memory:	428 KB	1.16 MB
ntdll.dll
Total CPU:	0.00112667%
Kernel CPU:	0.00112667%
User CPU:	0.00000000%
CPU cycles:	14,846/sec
Memory:	1.36 MB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Distribution by Windows OS

OS version	distribution
Windows 7 Ultimate	35.71%
Windows 7 Home Premium	35.71%
Microsoft Windows XP	14.29%
Windows Developer Preview	14.29%

Distribution by country

Canada installs about 28.57% of dsk service.

Distribution by PC manufacturer

PC Manufacturer	distribution
Acer	33.33%
Compaq	22.22%
Toshiba	22.22%
Hewlett-Packard	11.11%
GIGABYTE	11.11%

Remove Adware and Spyware Programs, FREE Download!