File description |
Alg.exe with description Application Layer Gateway Service is a process file from company Microsoft Corporation belonging to product Microsoft® Windows® Operating System.
The file is
digitally signed from Microsoft Windows - Microsoft Time-Stamp Service
We do not recommend removing digitally signed files from Microsoft Windows
What is alg.exe?
Alg.exe is, according to Microsoft's definition, the Application Layer Gateway Service. It is a necessary process for Internet Connection Sharing, as well as the Windows Internet Connection Firewall. Additionally, it provides the ability to use third-party protocol plugins, such as for a third-party firewall.
If you use the Windows Firewall or Internet Connection Sharing, do not kill this process. Doing so will cause you to lose network connectivity until the next reboot. If you use a third-party firewall, you also may need to keep it running. Additionally, many other pieces of network-related software, such as Intel Pro/Set, is known to require it to be able function properly. It is therefore recommended that you do not disable the Application Layer Gateway. The screenshot below illustrates how alg.exe should appear in the task manager:
Notice that this process runs as LOCAL SERVICE. An alg.exe process running as a different user may be indicative of malware.
Dangers of alg
As alg.exe is a process that runs on most Windows NT-based systems (including Windows 2000, XP, and Vista), it is common for virus writers and spyware vendors to make their malware appear to be the genuine system process.
Some of the fake files will have the same name but will be stored somewhere other than in %SystemRoot%\System32. Other malware will use a name that appears similar to the name of the legitimate process but with slight differences in spelling or with appended digits. The following malware is known to disguise itself as alg.exe:
- W32.Tufik (%SystemRoot%\alg.exe)
- This virus automatically downloads and installs several other pieces of malware. If you discover this virus on your system, run a full virus and spyware scan. This virus also infects .exe files, which may require a repair installation of Windows.
There will typically be only one instance of this process running at a given time. If more copies than this are running, one of the instances may be malware.
Common problems
- Your firewall warns you that alg.exe is requesting access to the network
- This symptom is typically caused by running more than one firewall at a time. If you are running third-party firewall software, ensure that the Windows Firewall is disabled.
- Alg.exe listens on port 1025
|
Automatic startup locations |
 |
001 Running Processes |
 |
002 Autorun registry entries local machine |
|
003 Autorun registry entries Current User |
 |
005 Current user startup startmenu |
|
006 Start Menu\Programs\Startup |
 |
010 Installed services |
 |
035 Active Setup Installed Components |
|
063 BootExecute |
|
065 Image File Execution Options (debugger) |
|
166 HKCU Policies\Explorer\Run |
|
167 HKLM Policies\Explorer\Run |
|
Digital signatures found for this file |
| |
Signer of certificate |
Issuer of certificate |
 |
Microsoft Windows |
Microsoft Time-Stamp Service |
|
Microsoft Windows |
Microsoft Timestamping Service |
|
Microsoft Windows |
VeriSign Time Stamping Services Signer |
|
Microsoft Windows Component Publisher |
Microsoft Timestamping Service |
|
Microsoft Windows Component Publisher |
VeriSign Time Stamping Services Signer |
|
Microsoft Windows Publisher |
VeriSign Time Stamping Service |
|
Microsoft Windows Publisher |
VeriSign Time Stamping Services Signer |
|
Microsoft Windows XP Publisher |
VeriSign Time Stamping Service |
|
Microsoft Windows XP Publisher |
VeriSign Time Stamping Services Signer |
|
Microsoft Windows XP Publisher (Europe) |
VeriSign Time Stamping Service |
|
|
MD5 security rating in our database |
 |
 |
|
563 |
files (Not yet rated
and
not
signed) |
|
|
1 |
files (Not yet rated
and
digitally
signed) |
 |
|
2 |
files (Safe
and
not
signed) |
|
|
207 |
files (Safe
and
digitally
signed) |
|
|
|
Some versions of this filename have not yet been checked for safety.
|
| Warning: Some malware might rename itself to alg.exe. Always make sure that your file is from a verified publisher. |
|
Application errors |
|
| User comments. |
 |
If the said alg.exe is installed by Microsoft then why the onecare, which is a product of Microsoft, asks whether to allow that exe to run or stop?
Feels something fishy. |
|
|
Database statistics
Top process list
