What is UNCServer.exe?
UNCServer.exe is part of UNCServer according to the UNCServer.exe version information.
UNCServer.exe's description is "UNCServer"
UNCServer.exe is digitally signed by Lenovo.
UNCServer.exe is usually located in the 'C:\Program Files (x86)\Lenovo\System Update\' folder.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
The following is the available information on UNCServer.exe:
| Property | Value |
|---|---|
| Product name | UNCServer |
| File description | UNCServer |
| Internal name | UNCServer.exe |
| Original filename | UNCServer.exe |
| Legal copyright | Copyright © 2016 |
| Product version | 5.7.0.42 |
| File version | 5.7.0.42 |
Here's a screenshot of the file properties when displayed by Windows Explorer:
| Product name | UNCServer |
| File description | UNCServer |
| Internal name | UNCServer.exe |
| Original filename | UNCServer.exe |
| Legal copyright | Copyright © 2016 |
| Product version | 5.7.0.42 |
| File version | 5.7.0.42 |
Digital signatures [?]
UNCServer.exe has a valid digital signature.
| Property | Value |
|---|---|
| Signer name | Lenovo |
| Certificate issuer name | Symantec Class 3 SHA256 Code Signing CA - G2 |
| Certificate serial number | 0174a35a3b95c3ea85d1eeb3ff945c4e |
Hashes [?]
| Property | Value |
|---|---|
| MD5 | 799cbc2f7c0eb0c02bea2eae49205cf8 |
| SHA256 | 229ab9ac0c292edf55a7bd77c9f62304151228b00376a307c9d2ba50847abc90 |
Error Messages
These are some of the error messages that can appear related to uncserver.exe:
uncserver.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
uncserver.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
UNCServer has stopped working.
End Program - uncserver.exe. This program is not responding.
uncserver.exe is not a valid Win32 application.
uncserver.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with UNCServer.exe?
To help other users, please let us know what you will do with UNCServer.exe:
What did other users do?
The poll result listed below shows what users chose to do with UNCServer.exe. 50% have voted for removal. Based on votes from 6 users.
NOTE: Please do not use this poll as the only source of input to determine what you will do with UNCServer.exe. Only 6 users has voted so far so it does not offer a high degree of confidence.
Malware or legitimate?
If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.
And now some shameless self promotion ;)
Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.
If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
a find that abaut on
http://www.mcbsys.com/blog/2013/06/lenovo-system-update-uncserver-exe/
Lenovo System Update UNCServer.exe
Mark BerryJune 11, 2013
I had a moment of panic this morning when I discovered UNCServer.exe running on my Windows 7 workstation. I thought it was a VNC server, which could allow external control of my PC. Do I have a virus? I immediately unplugged my network cable and started researching.
I first noticed this when using Alt+Tab to flip through applications. UNCServer is listed as an application, although selecting it does not open a window:
Lenovo UNCServer 1
Task Manager shows the program and path:
C:\Program Files (x86)\Lenovo\System Update\UNCServer.exe
Lenovo UNCServer 2
Probably Not a Virus
So apparently it’s part of Lenovo System Update, as this article and this post confirm. The file is also digitally signed by Lenovo.
The article and post also point out that the program opens firewall ports. The program grants itself access on all TCP and UDP ports for both the Domain and Public profiles:
Lenovo UNCServer 4
So it’s from Lenovo, and others see the same thing, so it’s probably not a virus. I still wondered what it does.
Probably Not VNC
Task Manager says it’s running as PID 9996. Checking for listening ports, we see that PID 9996 is listening on port 20050:
Lenovo UNCServer 3
In case this was a just a renamed VNC server, I installed the viewer portion of RealVNC and UltraVNC on another computer. Neither one was able to connect to my workstation on port 20050. Good.
Next I tried a Raw connection from Putty to port 20050. I had to turn on logging to capture the message that flashed across the screen: “Server encountered an internal error. To get more info turn on customErrors in the server’s config file.” That would seem to refer to the UNCServer.exe.config file in C:\Program Files (x86)\Lenovo\System Update. That looks like a .NET config file, and in fact it contains references to what appear to be .NET versions. I did not try adding a customErrors line.
.NET Analysis
I opened UNCServer.exe in IL DASM, part of the .NET framework SDK. Sure enough, it’s a .NET executable:
Lenovo UNCServer 5
At first glance at the procedure names, UNCServer.exe seems to be mostly about transferring files, not about remote control. So why does it need open ports on the inbound firewall? Is it supposed to allow an external program to connect to my computer to transfer files? My edge firewall should prevent connections from outside the network, but I still don’t like it.
When Does It Start
After a reboot, I noticed that UNCServer.exe did not start as soon as I logged on. However, it did start when I started Lenovo System Update, and it closed when I exited System Update. With System Update closed, nothing is listening on port 20050, although the firewall exceptions are still there.
So apparently System Update was running when I happened to see UNCServer this morning. Why? In Task Scheduler, TVT > TVSUUpdateTask is scheduled to run monthly on the 4th of the month. That’s a week ago. When I ran it manually, it finished in one second, but it left UNCServer.exe running. Then after a few minutes, I got a balloon notification from Lenovo that updates are available. Sure enough, there’s System Update in the system tray:
Lenovo UNCServer 6
At this point, UNCServer.exe is still running. If I right-click on the red Lenovo icon in the system tray and choose Exit, UNCServer.exe closes.
So if you don’t want UNCServer.exe to start, the (so far untested) options are:
Uninstall Lenovo System Update.
Disable the task TVT > TVSUUpdateTask. That should prevent Lenovo System Update from running on a schedule and leaving UNCServer.exe running in the background. However you would still be able to run Lenovo System Update manually.
# 25 Jan 2017, 4:11
eugenio writes