Is this running malicious software from a System.Shell.execute?

Question

I have downloaded a Window Gadget and found this function from the javascript. What this function does? Is it malicious?

Before I run the Widget, I commented out first the function call and it seems this function is not necessary to run the widget.

function LaunchPowerApplet()
{
    System.Shell.execute(System.Environment.getEnvironmentVariable("SystemRoot") + "\\system32\\mblctr.exe");
}

Judging by the Execute, it executes something in the system root\system32 called mblctr.exe (Windows Mobility Center) - more info on mblctr can be found here: http://bit.ly/172q1hP — Stuart.Sklinar, Aug 30 '13 at 07:38
@VAGABOND: Yes it is Javascript, targeted for Windows Sidebar probably. — Michael Foukarakis, Aug 30 '13 at 07:38
http://msdn.microsoft.com/en-us/library/windows/desktop/ms723232(v=vs.85).aspx — Benjamin Gruenbaum, Aug 30 '13 at 07:39

Álvaro González · Accepted Answer · 2013-08-30T07:55:37.770

System.Shell.execute is a method from the Windows Sidebar API that is used to launch an application.
%WINDIR%\system32\mblctr.exe is the executable for the Windows Mobility Center, a tool that «puts commonly used laptop settings in one spot so you can access them easily on the go».

Whether it's necessary or not is hard to say without knowing what the gadget needs to accomplish. The function is called LaunchPowerApplet and Windows Mobility Center allows to configure the battery usage settings. It makes sense if the gadget is a battery level meter, it doesn't if it's a solitaire.

BTW, a gadget is «a collection of XML, HTML, Microsoft JScript, and Cascading Style Sheets (CSS) files» so it's technically not JavaScript but JScript (Microsoft's ECMAScript implementation)

score 1 · Answer 2 · answered Aug 30 '13 at 07:42

1

Thia is just a windows mobility center exe it will help your gadget to run correctly. it will not harm your computer.

answered Aug 30 '13 at 07:42

Mohamed Rafiq

65
1
7

score 1 · Answer 3 · answered Aug 30 '13 at 07:43

I wouldn't say it was malicious since the application it is trying to launch is a standard windows component.

Why it wants to launch the Mobility Center is a bit of a mystery, but without further context about what this widget is supposed to be able to do we can't comment.

Is this running malicious software from a System.Shell.execute?

3 Answers3