Error code 0x80090002 and 0x80004005

Greetings,

When trying to upload unrecognized files to COMODO, via CIS (advanced GUI) “Unrecognized files” button, I’m getting the error codes 0x80090002 (Bad Hash) for two files and 0x80004005 (Unspecified error) for three files.

  1. What exactly are these error code meaning and what should be done when encountering them?

The two files associated with 0x80090002 are .bat script which I made.

The three files associated with 0x80004005 are the following powershell scripts (but the .ps1 files in C:\Windows\TEMP\ are missing):

  • -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\TEMP\pss2C91.ps1"

  • -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\TEMP\pss3976.ps1"

  • "Get-WmiObject Win32_Process | Where-Object { $_.ExecutablePath -eq 'C:\Users\Non-admin-current-user-session\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe' } | Select @{Name='Id'; Expression={$_.ProcessId}} | Stop-Process -Force"

  1. Regarding the error code 0x80004005 for the above scripts, is it normal to have such scripts on the PC? What are they mostly used for and to which softwares/services are they related to?

Thanks in advance,
Best regards,

B

I think you got the bad hash alert because they changed after they were first seen. They are likely batch files you have been working on.

I have always wondered about what that unspecified error means. Looking at your findings I would say it reflects they have been erased.

The Windows\Temp folder is used by Windows its self:

Source: https://softwarekeep.com/en-nl/blogs/tips-and-tricks/what-are-windows-temporary-files

1 Like

Thanks much for the Reply Citizen_K!

Regarding …\Windows\TEMP\ directory, would only Windows’ code/files be stored there? Does the three scripts are undeniably used by Windows?

Thanks in advance,

B

I never inquired that deeply but that being said, if scripts are unknown they will be contained by CIS. So I wouldn’t worry about them.

1 Like