Unkown exe file - does it belong to HP ProLiant iLO 2 Management Controller?

[fxsession1]

Hello all,

I have an unkown exe in c:\windows\syswow64

In the registry it's mentioned: "Shuts down the system in the event of overheating or loss of cooling in response to commands from the HP ProLiant iLO 2 Management Controller driver."

But does the process "C:\Windows\SysWOW64\bocofo.exe"  really belong to iLO 2 Management controller?

Can somebody confirm this?

Regards

[Suman_1978]

Hi,

Not heard of bocofo.exe file relating to iLO2.

But "sysdown.exe" is the file which is actually related to iLO2 with the shutdown service.

Below is the extract from hpqilo2.inf

[Sysdown.Service]
DisplayName   = %SYSDOWN.DESC%
Description   = %SYSDOWN.DESCRIP%
ServiceType   = 0x10               ; SERVICE_WIN32_OWN_PROCESS
StartType     = 2                  ; SERVICE_AUTO_START
ErrorControl  = 1                  ; NORMAL - display warning if it fails to load
ServiceBinary = %11%\sysdown.exe   ; System directory

[hpqilo2.Eventlog.Inst]
AddReg = hpqilo2.AddEventLog

[hpqilo2.AddEventLog]
HKR, , EventMessageFile, %REG_EXPAND_SZ%, "%%SystemRoot%%\System32\Drivers\hpqilo2.sys"
HKR, , TypesSupported, %REG_DWORD%, 7

[Strings]
HP_MFG          = "Hewlett-Packard Company"
HPQILO2.DESC    = "HP ProLiant iLO 2 Management Controller Driver"
SYSDOWN.DESC    = "HP ProLiant System Shutdown Service"
SYSDOWN.DESCRIP = "Shuts down the system in the event of overheating or loss of cooling " \
                  "in response to commands from the HP ProLiant iLO 2 Management " \
                  "Controller driver."
DISK.DESC       = "HP ProLiant iLO 2 Management Controller"
LEGACY.DESC     = "HP ProLiant iLO 2 Legacy Support Function"
REG_DWORD       = 0x00010001
REG_EXPAND_SZ   = 0x00020000
REG_MULTI_SZ    = 0x00010000
SPSVCINST_ASSOCSERVICE = 0x00000002 ; Associate service with device installed by this INF

Hope this info helps!