# entirex as a virus haven **URL:** \ **Category:** Forum\ **Tags:** Mainframe-Integration, EntireX\ **Created:** [November 20, 2014, 1:19pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437 "2014-11-20T13:19:34Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![Steve\_Robinson](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/steve_robinson/32/107_2.png) [@Steve\_Robinson](https://techcommunity.softwareag.com/u/Steve_Robinson)\ **Post date:** [November 20, 2014, 1:19pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/1 "2014-11-20T13:19:34Z")
I apparently acquired a virus on my pc. It has loaded itself into modules like etbadm and etbnuc inside the bin folder of Entirex. Apparently this is widely known (but not by me). Just google etbadm or etbnuc. Now the question. So far as I know, I have never installed Entirex on this computer. I have several SAG products on the computer; Adabas, Natural, Entire Connection, and NaturalOne. Which one would have installed Entirex? ---
**Author:** ![Rolf\_Bahlke](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/rolf_bahlke/32/109_2.png) [@Rolf\_Bahlke](https://techcommunity.softwareag.com/u/Rolf_Bahlke)\ **Post date:** [November 20, 2014, 1:56pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/2 "2014-11-20T13:56:22Z")
Steve, we have never heard of such an issue. Every workstation/server runs a virus scanner here. What virus scanner are you using? EntireX is most likely installed as part of Natural One. ---
**Author:** ![Steve\_Robinson](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/steve_robinson/32/107_2.png) [@Steve\_Robinson](https://techcommunity.softwareag.com/u/Steve_Robinson)\ **Post date:** [November 20, 2014, 2:22pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/3 "2014-11-20T14:22:12Z")
Hi Rolf; I use Avast. I have several times received a message from Avast that they blocked an attempt from a module (etbadm and etbnuc) to execute. Although I do have NaturalOne installed, it has been months since I used it. The messages have all been in the last couple of days. If I have read some of the posts on the web correctly, viruses can use these modules as a hiding place. This is evidenced, say the articles, by the size of the modules. etbadm, say the articles should be 28kb, on my system it is 51kb. My etbnuc is 3.34 mb, whereas the articles say it should be 1.784kb. I think I will simply uninstall NaturalOne for a “quick fix”, then investigate further. steve ---
**Author:** ![Rolf\_Bahlke](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/rolf_bahlke/32/109_2.png) [@Rolf\_Bahlke](https://techcommunity.softwareag.com/u/Rolf_Bahlke)\ **Post date:** [November 20, 2014, 2:28pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/4 "2014-11-20T14:28:22Z")
Hi Steve, the size if the modules depend on the version of EntireX. ---
**Author:** ![Steve\_Robinson](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/steve_robinson/32/107_2.png) [@Steve\_Robinson](https://techcommunity.softwareag.com/u/Steve_Robinson)\ **Post date:** [November 20, 2014, 2:45pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/5 "2014-11-20T14:45:13Z")
Hi Rolf; I tracked down the license key. It is indeed part of NaturalOne (license key is in \common\conf\ Saglicensekey one82.xml). Is there anything else in the license key which would indicate to you what the size should be (or should i attach the license key itself) steve ---
**Author:** ![Rolf\_Bahlke](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/rolf_bahlke/32/109_2.png) [@Rolf\_Bahlke](https://techcommunity.softwareag.com/u/Rolf_Bahlke)\ **Post date:** [November 20, 2014, 6:02pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/6 "2014-11-20T18:02:49Z")
Hi Steve, You can check the file properties for the version number. ---
**Author:** ![Steve\_Robinson](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/steve_robinson/32/107_2.png) [@Steve\_Robinson](https://techcommunity.softwareag.com/u/Steve_Robinson)\ **Post date:** [November 22, 2014, 11:31am UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/7 "2014-11-22T11:31:35Z")
Hi Rolf; Sorry, was out of the office most of yesterday. I have version 8.2.2.0 of webMethods EntireX What would be the proper sizes for etbadm amd etbnuc? steve ---
**Author:** ![Rolf\_Bahlke](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/rolf_bahlke/32/109_2.png) [@Rolf\_Bahlke](https://techcommunity.softwareag.com/u/Rolf_Bahlke)\ **Post date:** [November 24, 2014, 10:28am UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/8 "2014-11-24T10:28:23Z")
Hi Steve, for version 8.2.2.0 the two modules have the sizes as shown in the attachment. Note that this is for a 32-bit installation of EntireX. Please check if you have a 32 or 64 bit installation of EntireX. ![etbnucadm.png](https://global.discourse-cdn.com/techcommunity/original/2X/2/2aeebf7a1c4295c3d6ae828366419e5ca036573e.png) ---
**Author:** ![Steve\_Robinson](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/steve_robinson/32/107_2.png) [@Steve\_Robinson](https://techcommunity.softwareag.com/u/Steve_Robinson)\ **Post date:** [November 24, 2014, 12:41pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/9 "2014-11-24T12:41:00Z")
Hi Rolf; My sizes etbnuc 3.34 mb etbadm 51k etnattr 98.5 kb etbcmd 74.5 kb Without firing up entireX, where could I find whether I have the 32 or 64 bit installed? Needless to say, with everything very suspect, I do not want to start entirex. Could you check my sizes against both 32 and 64 bit? steve ---
**Author:** ![Rolf\_Bahlke](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/rolf_bahlke/32/109_2.png) [@Rolf\_Bahlke](https://techcommunity.softwareag.com/u/Rolf_Bahlke)\ **Post date:** [November 24, 2014, 1:32pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/10 "2014-11-24T13:32:44Z")
> [@Steve Robinson](#): > > My sizes > > etbnuc 3.34 mb > etbadm 51k > etnattr 98.5 kb > etbcmd 74.5 kb Looks good, I have (64bit): etbnuc 3,34 MB (3.511.328 bytes) etbadm 51,0 KB (52.256 bytes) etnattr 98,5 KB (100.896 bytes) etbcmd 74,5 KB (76.320 bytes) ---
**Author:** ![Steve\_Robinson](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/steve_robinson/32/107_2.png) [@Steve\_Robinson](https://techcommunity.softwareag.com/u/Steve_Robinson)\ **Post date:** [November 24, 2014, 1:57pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/11 "2014-11-24T13:57:43Z")
Thanks Rolf; Looks like my modules are just as they should be. Another Question. What might cause an attempt to run etbadm or etbnuc at startup time for my laptop? When I look at my startup list, neither NaturalOne nor EntireX is there. steve ---
**Author:** ![system](https://global.discourse-cdn.com/techcommunity/original/3X/c/d/cd19967bb605d28a72d77eb83a1cae22f3df2eb8.svg) [@system](https://techcommunity.softwareag.com/u/system)\ **Post date:** [November 24, 2014, 2:15pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/12 "2014-11-24T14:15:36Z")
Steve, have a look at your services, for example - Software AG EntireX Broker Admin is usually autostarted. ---
**Author:** ![Steve\_Robinson](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/steve_robinson/32/107_2.png) [@Steve\_Robinson](https://techcommunity.softwareag.com/u/Steve_Robinson)\ **Post date:** [November 24, 2014, 2:22pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/13 "2014-11-24T14:22:54Z")
Hi again Rolf; Would the CheckPoint software (from Software Technology Ltd) start EntireX? It is present in the startup list. Not sure why. steve ---
**Author:** ![Steve\_Robinson](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/steve_robinson/32/107_2.png) [@Steve\_Robinson](https://techcommunity.softwareag.com/u/Steve_Robinson)\ **Post date:** [November 24, 2014, 2:25pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/14 "2014-11-24T14:25:20Z")
Thanks Wolfgang, See the note above to Rolf. I do not know why, but the Checkpoint Software is on the startup list, although I do not see why this would be. steve ---
**Author:** ![Rolf\_Bahlke](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/rolf_bahlke/32/109_2.png) [@Rolf\_Bahlke](https://techcommunity.softwareag.com/u/Rolf_Bahlke)\ **Post date:** [November 24, 2014, 3:05pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/15 "2014-11-24T15:05:54Z")
Hi Steve, I don’t know what the CheckPoint software is doing. But I doubt that it starts others services. The Software AG EntireX Broker Admin service mentioned by Wolfgang is running per default (see attachment). You should stop the service and set the Startup type to Manual or Disabled. ![service.JPG](https://global.discourse-cdn.com/techcommunity/original/2X/9/9df26dd05519460c1bdeb912f393d4a1b4b6fa6b.jpeg) ---
**Author:** ![Steve\_Robinson](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/steve_robinson/32/107_2.png) [@Steve\_Robinson](https://techcommunity.softwareag.com/u/Steve_Robinson)\ **Post date:** [November 24, 2014, 4:43pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/16 "2014-11-24T16:43:17Z")
Hi Rolf & Wolfgang I think Wolfgang hit on the proper reason. Software AG EntireX Broker Admin must have autostart as its option, and probably when you install NaturalOne, part of entirex gets installed as well. I will have to see if I can get to change it since when I click on etbsrv, as you did to get the screen you posted, that screen “blinks”, but does not make itself available. I will play a bit to see if I can get to change it. ---
**Author:** ![system](https://global.discourse-cdn.com/techcommunity/original/3X/c/d/cd19967bb605d28a72d77eb83a1cae22f3df2eb8.svg) [@system](https://techcommunity.softwareag.com/u/system)\ **Post date:** [April 2, 2021, 3:32pm UTC](https://techcommunity.softwareag.com/t/entirex-as-a-virus-haven/179437/17 "2021-04-02T15:32:26Z")