Versions

2.1.0.0138	4.35%
2.1.0.0138	17.39%
2.0.0.0130	4.35%
1.2.0.0099	19.57%
1.2.0.0071	15.22%
1.1.0.2054	15.22%
1.1.0.0051	2.17%
1.0.0.0049	4.35%
1.0.0.0045	10.87%
1.0.0.0040	6.52%

Warning 4 antivirus scanners has detected malware in various versions of mediasrv.exe.

There are 10 versions of mediasrv.exe in the wild, the latest version being 2.1.0.0138. It is started as a Windows Service with the name 'Bluetooth Media Service' and described as “Provides Bluetooth Media Profiles support”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). This is executed as a shared service (which simply means that this service can share a process with other Win32 services). The average file size is about 1.25 MB. The file is a digitally signed and issued to Intel Corporation by Intel Corporation. Numerous variations of mediasrv.exe have been installed with both Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology and Pharaoh Puzzle. During the process's lifecycle, the typical CPU resource utilization is about 0.0004% including both foreground and background operations, the average private memory consumption is about 4.19 MB with the maximum memory reaching around 6.97 MB and typical read I/O operations are around 46 Bytes per minute.

Based on 40+ industry antivirus scanners, 4 of them detected the following malware.