Thursday, November 3, 2011

Windows Firewall blocked netsession_win.exe - Akamai NetSession Installware

Recently I had a Windows 7 user who told me that Windows Firewall had blocked an outgoing connection for a program called "netsession_win.exe" which was in the directory "C:\Users\<username>\AppData\Local\Akamai", and wanted to know if it was a virus.

Of course, we all know Akamai, one of the leading providers of content caching and distribution networks among other things.

Upon further review, it appears that the Akamai NetSession Interface is some sort of download accelerator/caching tool, but it is not clear how the user got that particular tool on their system.  It does have an entry in the Windows control panel with some administrative tools.

This app appears to be installware - i.e. a program, not necessarily malicious (but annoying) that was installed without the user's knowledge or direct consent, but included with some other download or via an automatic download mechanism.  There is a long list of companies that appear to use this tool.

If you have a legitimate install of this program, and don't want it on your machine, there is a simple uninstaller (as well as a README.txt that explains what the program is) in the same folder it is installed in.  The program does mention that it might just get installed again via some other download or site.  Uh, hello, that's annoying!

The Akamai website also includes another uninstallation method:

"How do I uninstall the Akamai NetSession Interface?
Windows: The Akamai NetSession Interface is a network library integrated into other applications. When you uninstall any of those applications, the library uninitializes. If you wish to uninstall the Akamai NetSession Interface, go to the AdminTool found at C:\Program Files\Common Files\Akamai\AdminTool.exe"

UPDATE 11/8/2011: It is clear by now that a huge number of people experienced this issue.  Over the last weekend, I put in a call to Akamai Customer Technical Support - (877) 4-AKATEC (US and Canada only) or (617) 444-4699.  Surprisingly, I was put through directly to a tech within minutes of calling.  I suggest if you are seriously concerned about this, that you give them a call and report the problem.  The tech I spoke to made a note of the issue, and gave me the same information that is listed on their website - that Akamai does not actually directly install this software, but that their partners (see the list of companies) do often bundle the installer.

The interesting thing is, I can actually verify through the Windows Event Log that this installer started on 11/3/2011 at 5:59 PM Pacific Daylight Savings Time (PDT).  There is an event ID 1040 with the message "Beginning a Windows Installer transaction: C:\Users\<USERNAME>\AppData\Local\Temp\RarSFX0\installer_msi_win.msi. Client Process Id: 41500.".

Furthermore, this user happens to track their time for billing purposes using tools that record what programs they are working in, so I know exactly what programs they were actively using at this point in time.  This user was browsing the Microsoft Healthvault website in Google Chrome immediately before this installer process started at the time mentioned above.  That doesn't scream to me to be a particularly clear infection route.

It seems almost a guarantee that something automatically triggered the installer, whether it was timed, an update of some sort, or some other process.

241 comments:

  1. Just happened to me, too (11/3/2011 6:30 PM MST). Uninstalled.

    ReplyDelete
  2. Just had the same Windows Security notice. The only program I installed today was Adobe Reader X, so maybe that is the source....?

    ReplyDelete
  3. Same message just popped up for me. I had installed Windows Downloader application yesterday to install a licensed Windows product.

    ReplyDelete
  4. Windows Firewall notice popped up while I was updating League of Legends.

    ReplyDelete
  5. i didn't install anything. in fact its been months.
    i have no clue where this is coming from.

    ReplyDelete
  6. Same here... just now

    ReplyDelete
  7. And I just was forced to upgrade the newest flash player... noticed it the same time. Strange.

    ReplyDelete
  8. i'm show this popped message, what i can do? block or not block, this is the question...

    ReplyDelete
  9. I didn't install anything either

    ReplyDelete
  10. Got to comment, I just got that message too. The weird thing is that I turned my computer on and other than logging in did not use my computer until now, as I write this so about 7 hours later.

    Should we delete this program be it malicious or otherwise I hate superfluous stuff running that I don't need as it affects performance.

    Cheers all

    ReplyDelete
  11. Same here. Just popped up out of the blue. Wasn't installing any program.

    ReplyDelete
  12. Yep I just got the same message while playing Half Life 1 on steam.

    I looked it up and the best thing I can find is programs like Adobe use it to update. But the adobe updater has never had this problem before.

    ReplyDelete
  13. I just returned home from a 4 month vacation. Yesterday was the first time this PC has been turned on since July 19. Nothing has been installed since then. Yet, today, on November 3rd, it started blocking this netsession_win today, out of the blue.

    Given that I have downloaded NOTHING in months that could have downloaded this software, and given how many of us experienced this all on the same day, it's very clear what's going on here: bot network. We all got this malware months ago and it's been waiting for today to send HTTP requests to something, likely executing a denial of service attempt or similar.

    -Lance

    ReplyDelete
  14. By the way: Akamai isn't associated with Amazon's MP3 downloader is it?

    ReplyDelete
  15. I think the process is linked to Apple's iCloud. If you have the new Apple iOS 5 operating system for your iPhone, you should also have iCloud on both PC and device.

    I found some news articles online about Akamai partnering with Apple for the iCloud system. Just a guess...

    ReplyDelete
  16. wow...popped up at me too when playing League of Legends

    ReplyDelete
  17. weird, me too just now. First time ever, so googled it, came here. playing a SOE game when it happened.

    ReplyDelete
  18. seems like all of us have received notification from this thing around the same time...how odd!

    ReplyDelete
  19. I just received this same message after upgrading Java flash.

    ReplyDelete
  20. Same here. Also my 360Amigo warned me that the startup list had been modified.

    ReplyDelete
  21. Quote:
    I've finally figured out what exactly this Akamai Netsession program is and where it came from. It was downloaded to my computer when I signed up for Netflix and watched a movie via their online video streaming. Netflix uses Akamai to quickly and smoothly stream videos with minimal buffering and almost no download time. It's not harmful, it doesn't seem to use a lot of resources (I could be wrong, but it doesn't on my computer), and is necessary for viewing Netflix, and other websites that stream videos online.

    ReplyDelete
  22. Weird this happened to me too while playing STALKER Clear Sky... a conspiracy? And now I'm having power fluctuations.......... luckily I have a backup battery or else this sentence wouldn't be completed. O.o

    ReplyDelete
  23. Also happened to me. no recent installations.

    ReplyDelete
  24. reçu à l'instant rien de chargé sur ce pc juste skype ouvert

    ReplyDelete
  25. Add one to "within last hour". Never seen it before.

    ReplyDelete
  26. Well I did install audiobooks downloader recently and also the IOS5 so got to be one of the two.

    ReplyDelete
  27. Just happened to me... Wasn't installing any program.

    ReplyDelete
  28. I also got this and had no installations in days. How odd!

    ReplyDelete
  29. 15 min ago I was just browsing in Chrome and it popped up. I actually doubt it's related to Chrome, and I also think it very odd that mostly everyone seems to have been getting it today.

    ReplyDelete
  30. Em I was installing updates to SuperAntiSpyware, but this didn't happen until hours after that. I assume it's trying to access people's private networks and such as it is mine?

    ReplyDelete
  31. Same popup, same date. Might have been downloaded or installed a long time ago? Why does it say incoming but specify a local program? is that the program that was listening on the port?

    ReplyDelete
  32. Maybe MS Security Essentials downloaded something in the last update that is triggered by some software we all have (Adobe?) which did something "suspicious" in the last hour. Maybe that suspicious thing has been happening regularly, but Security Essentials just found it suspicious today for the first time. That's my theory.

    ReplyDelete
  33. I was doing absolutely nothing and then I saw the computer screen showing that firewall thing. I didn't even do anything or install anything for a long time. I cancel it

    ReplyDelete
  34. Same problem here with win Firewall.

    ReplyDelete
  35. Thanks, I had the same problem today. Your blog was helpful. I just uninstalled it.

    ReplyDelete
  36. Whoa just happened to me too.
    -Honolulu, HI

    ReplyDelete
  37. yo solo prendi mi computadora el dia de hoy y aparecio...i want to now what to do..block it or not, is it safe?

    ReplyDelete
  38. I think that everyone having this happen on the same day is very fishy. It could be a phishing attempt or just that every single last one of these sites uses the same downloader.... possible but highly improbably.

    ReplyDelete
  39. The thing is creating a log in this akamai folder (on both user and common files directories).

    Till the firewall warning it was logging "debug.log.date_time.sent"
    After the firewall warning it changed into
    "debug.log.date_time.upload"

    At my computer the logging started October 28, whilst netsession_win.exe is dated October 29 and akamai seems to be installed on July 12.

    So, which nuclear facility are we attacking together at this time? :-) (DuQu?)

    ReplyDelete
  40. just got the same message also. My guess it is a new definition to MS that now recognizes netsession_win.exe as threat. Same thing happened recently with MS Security Essentials and G Chrome. I think Ill uninstall the Akamia thing all the same....

    ReplyDelete
  41. This program is often used by various online games, and is generally not a cause for concern.

    I am more likely to think that the issue is inconsistency on Microsoft's part, given that I have had both Akamai and the game with which it came, Grand Fantasia, installed for months with no issue at all, and now all of a sudden Windows Firewall wants to block the program.

    I am not sure what could have changed, or what the significance of this date is. I do not update Windows at all, so it is not due to a Windows update.

    I haven't made changes today, actually, so it is curious why all of a sudden everyone is getting this pop up.

    ReplyDelete
  42. same here. watching online tv series on megavideo

    ReplyDelete
  43. just got, whats goin on. no installs no changes. working in java on side

    ReplyDelete
  44. I had this too today. last thing i installed was a download manager from dishnetwork for a few shows that use it on dishonline. it is defualted to no upload, but it could easily be used as a peer2peer file sharing interface. I dont like the idea of my computer being used as a part of a bot network, even if its only 1-2% of my cpu or bandwidth. you can find it and uninstall it in your user\appdata\local folder, should be in a folder called Akamai

    ReplyDelete
  45. Thx for the info.
    Just got this problem a day after I installed Adobe acrobat too.

    ReplyDelete
  46. just happened to me i had just installed some sims pets stuff.

    ReplyDelete
  47. Same here... To my knowledge here's all that's happened recently:
    Adobe did an update yesterday (I think) - not sure if it was Flash or Captivate v5 (I had a trial on my PC that has since expired);

    I also have had iTunes 10.5.142 open and running on my PC for several days. My iPhone 4 (original) and iPad (1G) are both running iOS v5 and all are linked via iCloud.

    I also have been running some Android-related root programs on the Win7 box (unsuccessfully, I might add), but I doubt that -everyone- who has posted here has that in common, so probably not a culprit.

    Going into TaskMgr I see that it's rundll32.exe and the Owner properties list "TrustedInstaller".

    ReplyDelete
  48. Mine just showed up as well. How very odd.

    ReplyDelete
  49. Same thing happened just now, uninstalled.

    ReplyDelete
  50. Just happened to me too...unsure what I installed that did it, but here it is. I've uninstalled it now. Thanks.

    ReplyDelete
  51. That's funny that this popped up for everyone. I was just browsing the web on Chrome and it popped out.

    ReplyDelete
  52. Okay so in other words:

    1. Everyone is doing different things, except,

    2. We're all getting a notification that our respective firewalls,etc, are blocking this program

    3. This program is used for a number of things, but the question is, why is data being sent and received at this time and why does windows think it is suspicious?

    ReplyDelete
  53. I might as well join and too and it just popped up on my computer too (using Windows 7) I haven't downloaded anything lately. McAfee asked me what I wanted to do, and I just Blocked it.

    ReplyDelete
  54. Add another to the list. When I was removing it, some stuff said Flash Player. I used REVO to uninstall.

    ReplyDelete
  55. Oh, and something about Fox News...but I wasn't watching any video or anything.

    ReplyDelete
  56. To "Anonymous" that posted: I think the process is linked to Apple's iCloud. If you have the new Apple iOS 5 operating system for your iPhone, you should also have iCloud on both PC and device.

    I found some news articles online about Akamai partnering with Apple for the iCloud system. Just a guess...

    at 6:50 pm Nov 3rd

    Nope that's not it, I have none of this on my computer. You shouldn't make guesses like that.

    November 3, 2011 7:37 PM

    ReplyDelete
  57. Huh... just popped up for me. Last thing I actually installed was a week or so ago. Going to uninstall it.

    ReplyDelete
  58. I just had this pop up.

    The only applications I had running were pro tools audio software (which very few users will have) and itunes. So I would guess in my case it could be itunes - having said that I did update Skype today!

    ReplyDelete
  59. add another here..
    iCloud with multiple devices, Netflix and Battlefield 3 are the only things I've messed with in the last month.

    ReplyDelete
  60. Hehe, add another to the list. I, however, am not using windows 7, but Vista home premium. My comp has been on all day while I was at work, but nothing has been used/downloaded etc. I came in to check my email and this was already popped up *shrug*

    ReplyDelete
  61. Whatever this is, I don't like it.

    Programs that install themselves piss me the hell off. This is conspiracy quality shit. Let's all remove it.

    Please, PLEASE post removal methods so that we can completely eliminate this crap program. And then let's blow u...Uhhh go pay a visit to their headquarters.

    ReplyDelete
  62. I've never noticed this program in my Add/Remove before. Just got the Windows Firewall notice about it being blocked...stumbled on this page researching it.

    Decided to uninstall the program. If something breaks, I'll know what to blame.

    I would agree that there must have been an update to MSE that caused this to be detected as malicious.

    ReplyDelete
  63. Just got it also, I just installed Steam on my system is the only change we made

    ReplyDelete
  64. Check out REVO Uninstaller. It's great.

    I just want to note that I have a Battlefield 3 tab open on my browser, but I don't play the game on my computer...my kid plays BF3 on PS3. I saw someone else mention BF3.

    ReplyDelete
  65. My firewall blocked this, netsession_win.exe when I first started my computer. Where it came from, I don't know! There were two "akamai" progs listed when I uninstalled. They were listed as having been installed today 11/3.
    My question, HOW did they get installed today if my machine was off all day? I got that message Firewall blocked netsession_win.exe the moment after windows loaded. wft

    ReplyDelete
  66. To remove it, this is the file path. Enter it into Search on the Start menu and there is an Uninstall.exe file in the folder.

    C:\users\USERNAME HERE\appdata\local\akamai\

    It prompts that the uninstall will possibly cause problems with downloads or streams and that you may be prompted to re-install at a later date.

    ReplyDelete
  67. My guess is that it's related to the latest round of MS updates.

    ReplyDelete
  68. I had the same issue. uninstalled file from C:\users\......\appdata\local\akamai\netsession_win.exe. I haven't used Netflix on this machine in a while and the error just came up today... this evening upon booting up.

    ReplyDelete
  69. Got this today. I don't believe windows "just started recognizing it as a threat" because there's no trace of it on my system before today. The folder in program files AND appdata are marked as created today.
    Last things installed/downloaded
    icloud
    Elder Scrolls Oblivion
    team fortress 2 update

    just uninstalled, but it appears I had to run the two uninstallers to actually get rid of it. One under program files/common files, and one in appdata/local

    I don't like that most other google results just say "everything you need to know about akamai, go here" and provide a link to akamai's page, which has the most non-specific description I've ever heard. This is fishy as shit.

    ReplyDelete
  70. http://geekdrop.com/content/akamai-netsession-is-this-virus-what-is-it

    It's also happening on Non-Windows firewalls, like Comodo Firewall.

    ReplyDelete
  71. I got this on two separate computers today. Completely unrelated, one a laptop, one a desktop.

    ReplyDelete
  72. strange how everybody has the same excite message. and all of is from today Nov. 3, 2011. i receive this meassege too around 10:54 PST. look it up to see what it was and came here. ether this is some crazy virus or "worm" thing that i should click "block" or something that actually good for my computer and click unblock. but ether way i do hate thinks installed without my knowledge or my approved to have on my computer. even if its a good program or not

    ReplyDelete
  73. The readme.txt contains the following phrase:

    "When peer-downloading is enabled, your computer can serve as an upload source for other computers"

    I did not see a way to disable "peer-downloading" via their Control Panel or cmd line tools, which means I will be uninstalling it.

    ReplyDelete
  74. Kept it blocked by windows firewall, surprised AVG didn't block it, didn't uninstall either. We'll see what happens.

    ReplyDelete
  75. I got it too, and everyone about the same time, that's the weird part.
    If it just started showing up on the same day I would think it was just a virus definition update or something, but clearly whatever this was doing it was doing to all of us at the same time. THAT's the only part that freaks me out. (My computer had been on for hours before it popped up, and it had been idle for at least an hour when it did pop up. I have nearly all the software mentioned above, so that doesn't clear anything up.)

    ReplyDelete
  76. ethir this is an legitmaent hing to have. but still its scary that everyone is having the samethig too (myself included). hopfully it was the right thing for me to click "keep blocking" or "block" on my firewall. and later. we will see if this is normal thing, a national thing, world-wide thing (due to the fact that idk if this is happen everywhere outside of the US. because my friend called me, who also live in the states asked me about the same thing we all are having. hope to dear god this isn't a virus, malware,worm, hacker, keylogger, or whatever it is. not trying to atk our computers. i have some work data on my computer i dont want to loss at ALL!

    ReplyDelete
  77. I noticed some lag recently when gaming I'm hoping by uninstalling this fixes my problem. I've had issues before with accelerators like Pandomedia possibly lagging me while gaming so I am assuming this is similar.

    ReplyDelete
  78. I got this an hour or so ago while using photoshp cs5... I haven't downloaded anything recently...this is weird, and I consider my computer to be very secure....

    ReplyDelete
  79. So according to Akamai it's basically a hidden bittorrent-like system that let's Akamai pull bits of things out of your cached web files to deliver to other people that are viewing the same thing you already have. It's making it so that companies that pay Akamai get better service by using our network connections to help feed out data.
    That kind of pisses me off.
    I'm all about shared computing, but you'd better tell me up front about it.

    Here is the actual Akamai page that describes it:
    http://www.akamai.com/html/misc/akamai_client/netsession_interface_faq.html

    ReplyDelete
  80. I just turned my computer on and it popped up :s so weird! removed it all just in case anyway.
    last things to install:
    Skype
    TeamSpeak3

    Also I did do some google chrome theme changes the other day, aswell as install in extention "adblock" for google chrome.

    ReplyDelete
  81. It seems to have installed itself today while my computer was sitting unattended doing nothing. I came back and saw the popup from Windows Firewall. The AppData\Local\Akamai folder was created today and the Windows "Programs and Features" control panel showed it as having been installed today.

    I do have Adobe Photoshop Elements and Premiere Elements which I installed a couple of months agao so maybe the Akamai download manager was installed with them at the time -- and decided to replace or reinstall itself today maybe?

    Anyway, I uninstalled it.

    ReplyDelete
  82. Turned up today on one of my machines, only other thing new on it was a couple of Steam updates over the past two days and downloading the Steam version of DC Universe Online to try out today.

    ReplyDelete
  83. I'm going to buck the trend and allow it, to see what happens - I shall make every attempt to report back if I am instantly vaporised and teleported to a distant planet ...

    ReplyDelete
  84. I have the same thing. I don't have iCloud. I used Netflix in the past, but not for about 6 months. I haven't installed anything new for weeks.

    ReplyDelete
  85. I agree with Anonymous(@ November 3, 2011 8:08 PM) above that there are many new files in the folder that are created today, some files are dated from before.

    I don't like the idea of files showing up. And the suggestion that we should run "uninstall.exe" an executable that is one of those new files.

    I did find one file in the local\akamai\ folder "euc_state.json" that has 3 files that were updates with a bunch of metadata.

    1) "80652:http://trials2.adobe.com/Applications/FlashPro/CS4/Win/ADBEFLPRCS4Win_LS1.7z"

    2)
    "80652:http://trials2.adobe.com/Applications/FlashPro/CS4/Win/ADBEFLPRCS4Win_LS1.exe"

    3)
    "uIToolUrl":"https://client.akamai.com/install/bin/stub_win_b447b27/ui_win.exe",

    "https://client.akamai.com/install/bin/user_client_win_f5bc65d/installer_no_upload_silent.exe":

    The include local paths on my machine on the D:\ where I have an installation folder with my old installs.
    -----
    notice the 3rd executable installer_no_upload_silent.exe . I'm pissed that there would be a peer-to-peer software installed on my machine without me knowing, not knowing who the peers are, who has access to it, and having it silently communicate with the internet.

    ReplyDelete
  86. Just checked my Control Panel app for Uninstall/Change a Program. The most recently - and ONLY - program that was installed within the past week was... guess? Yep, it was the Akamai NetSession Interface, installed today. And I haven't even been home all day, so I know I didn't do it (and I wouldn't have anyway). Which means that it installed itself. Whatever happened to Windows UAC? Isn't that supposed to prevent programs/people making changes, installing software, etc., without Administrator approval?

    This is extremely disconcerting. I mean, it's great that Windows Firewall blocked it and all, but this means that someone (Akamai) has figured out a way around User Account Control. And if it is, in fact, a way to use our computers as a sort of internet cache for other users who are browsing/downloading the same content, then how do we know that is all that is being accessed? I'm not at all comfortable with that. In fact, even if that's NOT what it's for, I'm STILL not OK with a program installing itself and then trying to make an internet connection behind my back. It's actually quite infuriating.

    I'm seriously considering boycotting any and all software that utilizes or partners with Akamai, because I don't want this software showing up again. Because next time, they may have found a way to breach the Windows Firewall. I shouldn't need to have a government-class firewall to keep my data safe.

    And for the record, to whoever presumed that it was connected with the Apple iCloud - while it may be in some way partnered/used by the iCloud, they certainly aren't the only ones. I do not have ANY Apple software installed on my computer. I hate it. It tries to take over your computer - it's a major resource hog. My personal conspiracy theory is that Apple is secretly behind a lot of the viruses out there, which is why there are so many more viruses that attack Windows-based computers. Apple has hated Microsoft right from day one, so who has more motive to attack them? But then I really have no basis for that conspiracy theory, it's just an irritated rant because every bit of Apple software I have ever installed over the years has decided to conflict with several of my other programs, so I just don't like them.

    Anyway, I also don't use anybody's Cloud. If I wanted to be part of a cloud, I'd die and go to heaven. Until then, my data is mine, and it's not going to reside on anyone's hard drive but my own. So the Akamai thing may truly be an integral part of Apple's iCloud, or anyone else's cloud for that matter, but that certainly doesn't explain how it got on MY computer.

    ReplyDelete
  87. Yes, interesting to say the least. Been away from my computer for about 4 hours and when I come back, I see a Windows Security Alert. Am running Win 7. When I bring up Control Panel / Programs and Features, I see Akamai Netsession Interface and Akamai Netsession Interface Service, both installed today. Neither show any date or version info.

    What really bothers me is that is says it was downloaded by other software I had downloaded. Sadly, I haven't d/l'd any new software and this pops up as being installed at 6:32pm this evening when I wasn't even home and using the computer!

    So, I am seriously considering uninstalling this package. This really bugs me to find that someone is forcing me to install something without my knowledge and agreement ahead of time. It's just NOT good business practice to do this.

    Have noticed there are some debug log files that have been created at 6:32pm (the apparent time of installation), 8:32pm and now just another one at 9:32p. The files can be viewed with notepad but they don't make any sense to me. Will watch them overnight to see if they continue to be created every hour or so. If so, that tells me the routines are doing something with the system on a routine basis.

    ReplyDelete
  88. Wow so many today
    Just like mine

    Somehow it was programed to "call home" today and poped everyones outbound firewall.

    I uninstalled it in XP control panel and so far so good >No idea how it got in or why it "called home" tonight for so many of us!

    This is weird

    ReplyDelete
  89. Win XP Pro, restarted computer, updated Adobe Flash, updated Microsoft MSE security definitions, shortly thereafter the MSE firewall block message popped.

    I think it is something in the new version of Flash, combined with something in the new MSE definitions which is setting off the Win firewall.

    Not sure whether to uninstall or just continue blocking. I think I will select the "ask me later" block option, wait a day and update MSE again tomorrow and see if this happens again.

    ReplyDelete
  90. Same thing just happened to me.

    I wasn't even running any programs at all when the Windows Firewall popup appeared on my screen!

    And I haven't installed anything new on my computer for many months.

    Strangely, after searching for the netsession_win.exe file on my computer, the file isn't there! No results found. I was hoping to upload this file to virustotal.com or a similar site to scan it for malware infection. (I do have "Show hidden files and folders" checked, as well as "Display the contents of system folders", and unchecked "Hide protected operating system files", but it's definitely not there.)

    ReplyDelete
  91. Um, yeah... boycotting anyone who uses Akamai would be an exercise in futility. Although it would give you a lot of free time. Here's just a few of their customers:

    IBM
    Hewlett Packard
    Apple
    Microsoft
    AMD
    Logitech
    Nintendo
    General Motors
    Harley Davidson
    AUDI AG
    Toyota Motor Sales
    BBC
    NBC
    CBS Sportsline
    ESPN
    FOX Broadcasting
    Verizon Wireless
    Yahoo!
    NBA
    MLB.com
    NFL
    Turner Sports
    American Idol
    MTV Networks
    NASA.gov
    U.S. Air Force
    U.S. Army Recruitment

    To maybe get an idea how it got on your computer, look in the "Program Files\Common Files\Akamai\Cache" folder (would be Program Files (x86) for Win64 users). Sometimes if you purchase a download - from sheet music to MP3's to videos - the site will want to use the Akamai download software to facilitate the process, and you may have approved it without even considering that you were actually installing a piece of software. Just one of many possibilities for how you may have acquired it.

    ReplyDelete
  92. This Akamai netsession thing installed itself today on 2 of 4 of my home machines. Strangely, it installed itself only on machines running Vista and Win 7. The two unaffected machines are on XP SP3.

    Whatever this is, Akamai owes us at the very least an explanation as to how it could have installed itself on my computers WITHOUT permission. I did NOT install any software on my machines today.

    ReplyDelete
  93. I'm hearing reports from other places that this has something to do with google talk or video chat or something.

    I opened CCleaner and went to the uninstall tool, and the top program on the list is "Google Talk Plugin" installed today. I don't remember approving such a plugin, but I did check Gmail before this firewall notification popped up.

    I'm seriously disappointed in google if they're installing shit on our computers through chrome/gmail and not at least giving some kind of option.

    ReplyDelete
  94. uploaded file netsession_win.exe to virustotal.com via email - report says no virus

    ReplyDelete
  95. omg happend to me too\! must be a plague!!1

    ReplyDelete
  96. Just happened to me too. Install date is today, computer has been locked all night.

    ReplyDelete
  97. hi computer was running since yesterday in the morning. i have only visited faceboock then left and closed all. Now i have windows firewall blocking netsession_win....like somebody allready said it came out of the blue

    ReplyDelete
  98. Left the computer running at 9:15 PM EDT on the 3rd, got up at 3:30 this morning and there the message was on the desktop. Told Microsoft to block, checked my wife's laptop which was asleep and my laptop which was off. Nothing on either of them.

    ReplyDelete
  99. This is the skynet client which is currently in testing. You'll see similar messages on your other connected devices. nothing to worry about.

    ReplyDelete
  100. Looks like an auto-update of flash.
    The output from C:\Program Files (x86)\Common Files\Akamai\AdminTool.exe :
    Checking for Akamai client... installed.
    Executable version: 1.8.1.1
    Running executable: netsession_win.exe
    Configuration version: win_f5bc65d_1.8.1.1-RC2
    Is online: yes
    Download speed: 0Bps

    http://trials2.adobe.com/AdobeProducts/FLPR/11/win32/FlashPro_11_LS1.exe [Complete]
    CID#80652 C:/Junk/FlashPro_11_LS1(2).exe

    ReplyDelete
  101. Guys, I think u are overreacting. Every single one of us got it yesterday and a fair amount got the flash player update window. The same thing that happened to me.
    In my opinion giving the percentage of people having the same issue the same day i guess that pop-up of windows firewall came with the flash player. I don't like it either, i hate when i get third party programs installed but I think is safe.

    ReplyDelete
  102. Pretty sure I downloaded this from the NFL.com website. It was to "unlock HD" video highlights. It was a bit better, but by no means HD quality.

    ReplyDelete
  103. All I did was a Flash upgrade and I got it. Seems to be a common theme,

    ReplyDelete
  104. Ah -- reference to Terminator. I get it.

    What concerned me most was that it appeared the very instant that I clicked (Firefox) on a get-rich-quickie ad banner that lead to a video of a guy enthusiastically talking about how he uses Wordpress sites & Google to get 6 figure incomes with zero effort automated sites. Get system for $47. I actually felt better when I saw all of these other posts. When I scrolled down the page the Flash Player crashed and the Windows Update notification popped up saying updates were waiting to be installed.

    ReplyDelete
  105. As for things being installed on your computer without your knowledge or consent: doesn't that happen all the time? Maybe Akamai's long list of big-name clients is the result of owning patents on the concept of doing automatic updates.

    ReplyDelete
  106. Happened to me too, Just got up, so I wasnt even at the computer when it popped up. Happened between 12am EST and 6am EST it was Akamai netsession_win.exe I havent installed anything lately, or updated anything lately. I told it to block it because I hate things popping up when I'm not even at the computer. Makes me suspicious.

    ReplyDelete
  107. I may have been right about the patent thing.
    http://stks.freshpatents.com/AKAM-sym.php

    ReplyDelete
  108. Same problem ... but here's a thing ... me and my brother have two computers (on same network) and on one this Akami is present and on the other one (which is older and longer in use) is not. Mostly, we have and use the same programs and games .... the only difference is that on this one, my brother uses facebook.

    ReplyDelete
  109. It was on my work PC this morning when I came in.

    ReplyDelete
  110. Ditto... just got to work this morning and it had been installed yesterday... tripped the firewall between last night and this morning. Uninstalled.

    ReplyDelete
  111. akamai seems to be involved in streaming my CBS tv to my tablet. I knew that name looked familiar when I saw it pop up on this forum after getting the same firewall message.

    ReplyDelete
  112. Just got the same Firewall alert. Thanks to this article, I understood and uninstalled this app.

    Great article !

    ReplyDelete
  113. WinXP SP3 got it too.

    ReplyDelete
  114. Hello, i have the same problem, and i leave in Marseille (France).

    ReplyDelete
  115. Same here on Windows 7. Got the firewall blocking notice on Thu 3-Nov.

    Worse -- according to Task Manager, netsession_win is sucking 1% - 2% - 3% of CPU!

    ReplyDelete
  116. The last couple of times I used Youtube, there was a request to update an adobe file-no option to get rid of the message, just "remind me later"...annoying. I checked on line about the update request, and it was recommended, so I tried to update, but it would stop halfway through. The next day I got the message that netsession_win is being blocked. I am going to unblock, as this is probably why the download for Youtube did not complete. I have had problems with streaming videos since I switched to Vista OS so I had high hopes for this as the remedy. Will let you know.

    ReplyDelete
  117. This is my WORK computer, and I have absolutely NOTHING like games or any non-work related programs on this computer. I left my PC running yesterday afternoon when I went home for the night, and it was on my screen when I came in this morning. From reading everyones post above, it appears to be a time/date automatically initialized program. I do not watch videos or play games, so I do not know how or what this program is attempting to do. I WILL BLOCK this program. Good luck to all!

    ReplyDelete
  118. Everybody has the same problem but nobody knows exactly what to do!!

    ReplyDelete
  119. It is usually an ADOBE product uses the Akamai software. If you have Adobe Reader or Flash Player, or any other Adobe product installed you will have Akamai installed. It helps download updates etc.

    ReplyDelete
  120. Win 7 in Baltimore, MD. Work computer. Always leave it running. Only thing I did differently yesterday was launch Pandora with Chrome to listen to some stations yesterday. Blocked, removed from startup and then uninstalled.

    ReplyDelete
  121. Hi all!

    I too had this same thing popup this morning. I did a little research and here's what I found:

    If you open a command prompt window and run it will tell you which program(s) caused this to be installed. (on my system it was in c:\program files\common files\akamai)

    In my case it was Autodesk DesignReview.

    I hope this helps clear up some of the mystery.

    ReplyDelete
  122. an edit to my last comment:

    You have to run 'admintool listapps' to list the apps which caused the program to be installed.

    You can also run 'admintool help' for other commands.

    ReplyDelete
  123. It was on my computer when I got to work this morning. Mine doesn't seem to be attached to a certain program though. I didn't allow access and I will see if I need to uninstall. The only thing I did different yesterday is switch to the new version of gmail.

    ReplyDelete
  124. Same thing,the latest download was Adobe Air...
    It may be coincidence but my e-mail contacts have since been raided,this is the result-"Just a quick note. Did you send me an email about your having just received and Apple i phone with a link to where you bought it.?
    I only ask because the email looked a bit suspect and it was not your regular email address."B.

    ReplyDelete
  125. Okay, after leaving everything as it was last night I find that the log files were created about every hour throughout the night. Their content doesn't mean anything to me but this software certainly is doing something on a regularly scheduled basis.

    Take a look a the files which can be found (on a Win7 system) at:

    c:\users\yourusername\AppData\Local\Akamai\Logs\

    I just looked at my control panel and found the "Akamai NetSession Interface Control..." link. Click on that to view the Interface Console. I then selected the About tab and found the "NetSession Home Page" link at the bottom of that page. That brings up their webpage. On the lower right-hand side there is a "Contact Us"/feedback link. I clicked on that and sent them a message and told them what I thought of their policy of downloading, installing and running software on my personal computer without my knowledge and approval ahead of time. Will be interesting to see if I get a response from them.

    ReplyDelete
  126. In reference to an earlier post, "You have to run 'admintool listapps' to list the apps which caused the program to be installed.

    You can also run 'admintool help' for other commands."


    How do you get the admintool to run and stay on the screen? For me, it just flashes and then goes away. I tried to open a CMD window but that didn't help either...

    ReplyDelete
  127. Ran "Akamai NetSession Interface Control..." and found that it is showing under "Applications & Websites using NetSession" that Corel is the only thing using it. I do have Corel Paint Shop Pro X3 and did download an update a week or so ago. Don't understand why it is just now showing up as being blocked though.

    ReplyDelete
  128. @Anonymous [November 3, 2011 9:30 PM] I also found Adobe related URL's at AppData\Local\Akamai\euc_state.json here they are:

    "http://trials3.adobe.com/AdobeProducts/APRO/10/win32/AcrobatPro_10_Web_WWEFD.exe":
    "resumefilename":"Adobe_Acrobat_X_Pro_English_Windows",
    "resumeurl":"http://trials3.adobe.com/DlmResumeLink/www.adobe.com/cfusion/tdrc/resume.cfm?urlSetId=474587534&language=en&downloadName=Adobe_Acrobat_X_Pro_English_Windows&product=acrobat_pro_EN_US&loc=en_us"

    I believe is Adobe Update related sofware, they even mentioned the use of similar software at http://kb2.adobe.com/cps/402/kb402065.html

    But why this was installed and banned yesterday in so many cases I don't know but I guess at least knowing where it possibly came from, it might help to decided to allowing it or not.

    ReplyDelete
  129. I think Netflix subscribers were targeted. One other person mentioned this possibility.

    ReplyDelete
  130. this is one messed up thing, same here, i was just playing a game and poof there it was, firewall has found this thing and do you allow access or leave it, i clicked cancel so i could look it up, but the only thing i think ive resently installed was itunes, well updated that to the latest one but yea, confused much about it?

    ReplyDelete
  131. My computer was logged out all night. When I came in and logged in, this popped up. I have not even opened my e-mail or anything just logged in.
    Just checked my Control Panel app for Uninstall/Change a Program. The ONLY program that was installed within the past week was... This installed today.

    I have NOT installed or updated anything. My last update of anything was October 12. This is a work PC and I don't do netflix, iAnything, or any gaming on it. It visits no social networks and NO ONE can install anything on it without permission and the correct password.

    Glad the firewall caught it but annoyed to know that even with all the "safe guards" something STILL self-installed without anyone permitting it.

    ReplyDelete
  132. I'm in the UK. Just got home from being away all week. Comp was slow at starting up, then the firewall message pops up. Not installed with another program. But installed BY another program.

    Not happy.

    ReplyDelete
  133. Same as everyone else. Win7, firewall pop up yesterday. Akamai directory says it was modified yesterday. Could not get listapps to run, does not show as a command in admintool help either. However admintool with nothing else showed that it was used when I downloaded a program I purchased from Staples over 6 months ago. Odd that it shows up in firewall yesterday. Good idea to post on the Akamai website to complain. Will keep blocking but it is doing something every hour in the log and it is running in process explorer at a very low level.

    ReplyDelete
  134. As an addendum to my post here: November 4, 2011 11:45 AM

    I had to stop the service with extreme prejudice. It would NOT stop running and I had to terminate it manually. If you stop it in services, it just restarts.

    ReplyDelete
  135. thx for this site and all the inquiries and suggestions... I thought it was just me.

    ReplyDelete
  136. If you Stop the service via the NetSession control panel it does, in fact, stop the service but it restarts the service everytime you reboot your PC. There is apparently no way to force it not to restart on a reboot.

    Just one more indication of a software company the doesn't care what the user wants - you are forced to stop it everytime you reboot. BTW, if you uninstall it and then perform an update download again (which I just did), the Akamai software gets reinstalled without your knowledge or asking if you want it - it just happens. That really peeves me!!!!!!

    ReplyDelete
  137. I got the Windows Firewall pop-up last night. It just appeared out of the blue. Using Windows XP SP3. I wasn't running any apps on my computer when it popped up.

    I don't have netflix (I've never used it) & I don't have any games installed either, since I don't play them.

    I don't even have any Adobe products installed (apart from Flash Player, but auto-update is disabled). I only have a few apps installed on my PC & I haven't installed any new software for almost a year!

    I then opened the Control Panel & discovered an icon for "Akamai NetSession Interface Control Panel". There's no reason at all why this should be there! HOW THE HELL DID IT SELF-DOWNLOAD AND SELF-INSTALL WITHOUT MY KNOWLEDGE OR PERMISSION??!

    It was also listed in Add/Remove Programs, so I uninstalled it, BUT the icon in the Control Panel remains there! (even after I re-started my PC). When I double-click it, nothing happens.

    This sounds like a malware infection, possibly with a rootkit to hide its presence on your system.

    I'm trying to figure out how to remove it without having to format my hard drive :(

    ReplyDelete
  138. I too have the same problem since yesterday. Is it possible it came as one of the "windows updates" while your computer is shutting down? Mine does it almost every time i turn it off and I'm sure all of you had to turn your computers off as well.

    ReplyDelete
  139. ANYONE PLAY BEJEWELED BLITZ OR BUBBLE SPINNER? thats the only new thing i've done in the past 48 hours. Just trying to narrow it down

    ReplyDelete
  140. Well as interesting as it is that all these "trusted" companies are using this mighty fine piece of software, for "updating" etc... here's an interesting one for you. I did a netstat and found this thing contacting an ip. So I searched for the IP. here's the result...

    http://ip2geolocation.com/?ip=208.46.117.195&lang=en

    Now you will see the company name:
    Information Management Consultants, Inc.

    Guess what... THEY do work for just about everyone. I don't own a single piece of software that has been created by them. so why would I be sharing info with them? Well, the IP location is just outside DC, and they also happen to do an awful lot of work for the govt.

    I'm deleting/blocking it as well (since it ALSO contacts my computer) blocking it in the router.

    ReplyDelete
  141. Anyone want to load up wireshark, let it through the firewall, see what it's talking to and share the news? I didn't think to do this until after uninstalling it.

    ReplyDelete
  142. Regarding Wireshark - that is an interesting idea - I've also already uninstalled it from my user's PC too. However, it looks like you can re-install it (I am not recommending this, in fact, don't do it - just pointing out it is possible) from this url -> http://client.akamai.com/misc/demos/CustomInlineInstall.html

    I might just fire up a virtual machine and install this custom installer and see what happens with Wireshark. However, if the version that everyone else is getting actually turned out to be malware masquerading as this tool, then we'd need a copy of the installed version which is circulating in the wild, and not from the website listed above.

    ReplyDelete
  143. Had the same issue, and figured out where it came from. My PC was left on (locked) while away today. Came home and found the same firewall message, and also found the program had been installed about 30 minutes before I even unlocked the computer.

    In my case, I had recently installed AVG Free, which updated itself again today (to AVG 2012 Free), and downloaded Akamai. Apparently it now uses Akamai to download updates. I suppose I'm not getting those updates since I have not unblocked it yet in the firewall.

    As posted earlier, Akamai is in use by many companies all over the world. They are a dynamic web hosting (mirror) solution to speed up content delivery and as a fail-over solution, etc. Sometimes a web redirect to an Akamai server can be seen (or even questioned by your browser). In this case the technology is a downloader client that is installed, maybe even required, by other software that relies on it for auto-updates. It is not malware, it's part of a shift towards a more dynamic and intelligent internet.

    Now, that said... I'm sure it could be used for a malicious purpose if someone wanted to. Just like any other technology. It really comes down to trust. I wouldn't have a problem with it if I knew exactly why I had it and what it was doing. I think software companies should be more upfront about what all is included/required to use their product, and Akamai should have a better way to monitor and control exactly what their client is doing. Sure, automation is nice, but in a world of malware, it's all about trust. And we generally don't trust software to download and install other software on our behalf!

    See this thread:

    http://www.velocityreviews.com/forums/t306591-akamai-technologies.html

    More about Akamai:

    http://www.akamai.com/html/technology/index.html

    ReplyDelete
  144. I installed AVG last week then uninstalled it yesterday and later that day I too had this netsession_net blocked notice on my computer when I got home last night. It was there again just now when I got home. I've uninstalled it as suggested at the top of this page.

    I remember now that I had downloaded AVG Free a few years back and found them very pushy so I got rid of it after a month or so. Guess they are still annoying.....

    ReplyDelete
  145. I didn't know what it was. I came here. I decided to let it run. I am still able to surf for porn.

    ReplyDelete
  146. spybot search an destroy stops it on startup

    ReplyDelete
  147. Got this message after a Microsoft update for Win 7 yesterday, might have come in with the update.

    ReplyDelete
  148. Got this a few minutes ago... did a search, saw this article and posts and promptly uninstalled it. I downloaded nothing the past couple days and the only program I ran was CS5

    ReplyDelete
  149. same thing for me... i don't know where it comes from. and i'm on windows XP

    ReplyDelete
  150. Very odd, happened to me yesterday after work and starting my laptop. I think it´s intalled by Amazon MP3 Downloader (just purchased MP3s that morning....)

    ReplyDelete
  151. Yes I too have it and blocked it but after reading posts still am not sure this is not malware/virus. Reports are all over the board as to source and how it was obtained. I was unable to locate the uninstall that was reported above. I like many had some machines that never do video aquire it and some that do video not aquire it. I show no updates or installs on this machine since 10-29-11. Yet this did an install on 11-3 like everyone else. But another machine without it has done a MS update and adobe Flash and adobe Air. This just doesn't make sense. When I tried to contact MS Esentials I was rudly rebuffed, McAfee was no info, tech-net nothing, is it just us? Isn't someone beating on Akamai's door for answers? I would if I could do more than e-mail them.

    ReplyDelete
  152. Just happened yesterday. Thanks for the solution for this annoying problem!

    ReplyDelete
  153. I found my application not in the c:(your username)/users/AppData/local/Akamai/netsession_win I deleted it from here. It is a threat to my computer because it is changing my url directions to its website.

    ReplyDelete
  154. Great idea with the wireshark. I kept the program for a while, but as I looked more at the data in euc_state.json, I saw logs of adobe files it had transmitted, they were sent in the .7z zip format, and one was about 900 mb. I unzipped tried to go through it for a while. when I noticed that the .json file kept getting updated I removed the software. I agree with a previous poster that it is amazing that it was installed into Add/Remove programs on it's own at the same time. If anyone does still have a copy of this program on their machine,(an exact copy of what installed) we should use wireshark or another software to see exactly what information it is communication.

    ReplyDelete
  155. Seems that nobody has received this application from the same source and the 3rd of November is when most started noticing this annoying popup. I think there is more to this file/app than meets the eye.

    ReplyDelete
  156. I have also had something sending an email message out to various contacts from my contacts stored on my computer (i believe my outlook contacts). Seems strange that everyone received this file on their computers on the same day and around this time I have something sending messages with attachments through my contact list.

    ReplyDelete
  157. oh my i thought i only had the problem ... started when i installed steam ... but perhaps it updated itself without piggybacking on other software.. like an update of some sort from Akamai technologies or some other company/entity/group/site etc. as soon as you connect to the internet... or i could be wrong.

    ReplyDelete
  158. Well, it says it speeds up the downloads, but ever since the 3rd when it installed itself my downloads have been slow as snails.

    ReplyDelete
  159. Here is Akamai website with info you should consider if you want to uninstall (save cached files if you want to keep them). Akamai appears to provide a networked approach to streamlining downloads that includes pulling from the caches it creates on all of our machines. Whether you trust that or not, is a personal matter, but if you are a participant in any of the torrent mechanisms, you are already engaged in that kind of system.

    Regarding why it is all of a sudden popping up now, I believe that there has been a recent update to the Akamai components that are now in the process of updating themselves. New executable images will trigger our firewalls. This may be the first update since we originally and inadvertently installed it with some other software we were trying to download.

    Does make me wonder what other services I have running that are chatting away with their servers or services without my knowledge, whether they are malicious or beneficial. This kind of thing is not going away, but will expand rapidly as the digital world continues to insinuate itself into our lives.

    ReplyDelete
  160. Sorry, forgot the link. Here is is:

    http://www.akamai.com/html/misc/akamai_client/dlmv3_faq.html

    ReplyDelete
  161. every time i am on pc it sends a debug log to some one every hour or so an it won,t let me change name or delete logs,last time i stopped completly it mess pc up

    ReplyDelete
  162. I had read all of the Akamai dimv3 info but what bothers me most is I find nothing in the computer that indicates that I ever had this on the machine prior to 11-3. No logs show it. And in add-remove there is no publisher, size, or version listed for either of the listings "Akamai NetSession Interface" or "Akamai Net Session Interface Service". I have nothing in thier cach. I have it still on my computer but have the service shut off using their shut off boxes (you have to shut off both boxes separately even though they appear identical) if you don't one must somehow turn the other back on. It shows off in win services also. Thus I still have it on my computer and will look into wireshark. It's not a program I've used before.

    ReplyDelete
  163. I really think this came with the google talk someone mentioned above. I urge you to get it off your computer. It's messing with mine. I can't uninstall it...my firewall isn't working...the app file has something with a gibberish name running that I can't shut down. Tried rebooting my computer and it had problems at startup. Tried ending programs and separate processes and the box closed itself. Firefox wouldn't launch until I did I don't even know what. Running malware checks now. Any help would be appreciated guys. I'm a normal user too stupid to run regular backups...if I have to restore I have to go WAY back. Thanks in advance~

    ReplyDelete
  164. Why am I seeing a prompt to allow network access for "netsession_win.exe" and "netsession_mac"?
    "netsession_win.exe" and "netsession_mac" are the executable file names for the Akamai NetSession Interface software. Akamai continually improves the NetSession Interface software in order to provide the greatest performance to our customers. In order for NetSession to enhance and accelerate Internet content downloads and streaming it needs certain local permissions such as network access. Depending on the settings of the Operating System and Antivirus software these auto-updates may require confirmation from the end user.

    ReplyDelete
  165. i got that from this which was earlyer on in this large convo : http://www.akamai.com/html/misc/akamai_client/dlmv3_faq.html

    ReplyDelete
  166. Personally I am not considering this legitimate in any way. It popped up on a work computer that does no streaming to it at all, a CAD machine that the person also does some computer browsing on. I would say it is coming from an Advertisement on a website trying to use a sometimes legitimate used program to get around its ability to infect computers.

    ReplyDelete
  167. I have updated this post with a little additional information - please see above!

    ReplyDelete
  168. I think it is from the battlefield 3s "Origin", which in their eula allows them to access your hard drive and send your files to EA. Alot of dicussions around this latly, most in Germany. So I think this is their program sending them your information. So my conclusion, its Origin that installed this on your computer.

    ReplyDelete
  169. and another one, looked at the files and it was downloaded at the same time that my 8 year grandson starting playing game on the LEGO website. Only option was that I had to activate the game from link in an email from the website. There was nothing / no messages to accept terms and condirions.
    Blocked access via McAfee, just in case need to turn it on again

    ReplyDelete
  170. I just received the same message. My firewall asked me if I wanted to install, I said no. Have not downloaded anything.

    ReplyDelete
  171. Akamai's installer (if that's what it really is)is persistent to say the least. It has made 19 Create Process requests in the past week. If Akamai has a troublesome update on its hands, you'd think they'd disclose. I become very suspicious when a firm blows off a mass-reported phenomenon: "Nothing to see here, step away from the installer."

    Its cache indicates Akamai probably installed a year ago when I downloaded a trial of Adobe Dreamweaver.

    ReplyDelete
  172. i also found an article a year ago, and it seems they are already known for deliberately making the installation as transparent as possible. and the only way for the user to know this is if they read a thousand-words eula statement. i really do mind if a software that happens to be an online service is installed without consent. even more so, do an automatic update. why am i clueless of my own pc? *sigh*

    ReplyDelete
  173. I am quite positive i received the Akamai tool with the game "Need for Speed: World". I suppose EA's Origin would install it as well as maybe a handfull of other games

    ReplyDelete
  174. I came back from hollydays the 8th after 21 days of cpu shutdown. No pop up, no update. Yersterday night, my cpu crashes in black screen and after reboot black screen again - then windows updates itself step 3/3, I log in.

    Then, only this morning I get the firewall alert roughly:
    installer_no_upload_silent.exe installer_msi_win.msi

    It was shortly after updating League of Legend, known to use pando media booster, a p2p updating system, might be a clue?

    ReplyDelete
  175. I received this today. There was one item installed the same day. This was an update to mozilla firefox.

    ReplyDelete
  176. I received this as well today. When I uninstalled it, it said something about Joymax. I think I got it when I installed the MMORPG (which they handle) Digimon Masters.

    I think that this was triggered by me updating Windows 7 days later than everyone else. I updated yesterday and received this firewall blocking message today when I turned on my computer.

    Thank you for writing this blog post, SixDimensionalArray, I was really worried when that notification popped up.

    ReplyDelete
  177. I've been getting Comodo Defense Alerts for two days now.
    "installer_no_upload_silent.exe could not be recognized and requests unlimited access to your computer"

    Scary...right?? I realize the the exe is an Akamai file and used by many companies to deliver content. But as the Comodo Alert further states: "the publisher has not digitally signed their application. Hence the origin of this application should not be trusted"
    Comodo then recommends that you 'Sandbox' it....Well.... of course it it keeps coming back.

    Seems either one of two scenarios:
    Bad programing by Akamai.
    or
    Something BAD is trying to install itself.

    There are two files with the same date, 11 09 2011, in my C:\Program Files\Common Files\Akamai folder (among a handful of others and sub-folders). The two files are 3sec different in time. One, netsession_win_a74ca62.dll 3.15 MB (3,305,048 bytes) says it's Certificate is OK, but the other, the executable, installer_no_upload_silent.exe 8.04 MB (8,435,905 bytes) has no TAB on the Properties for the Version or Signature to be displayed. It does have a Compatibility Tab...seemed odd and 'old time' to me.

    Also noted in Event Viewer, a reoccuring error Event ID 7011. "Timeout (30000 milliseconds) waiting for a transaction response from the Akamai service.
    For more information, see Help and Support Center at"

    I'm guessing someone at Akamai goofed, but how does a person find out?

    ReplyDelete
  178. This just popped up on my work computer after a restart - stopped by Trend Micro. I did a search, didn't find any useful info on Akamai site that explained it's install, found the tool in the Control panel and decided to uninstall. I'm running a full scan. If the uninstall messes with another program, I'll just repair or reinstall.

    ReplyDelete
  179. i just got this...does it make it worse if this happened twice to me? it happened to me about the same time last year...

    ReplyDelete
  180. Trying to figure out whether this is related to a DNS lookup failure. I can't connect to the Net on the PC where the Netsession hidden window shows up as running in the background.

    ReplyDelete
  181. On win7.. if you goto C:\Users\XXXXX\AppData\Local\Akamai\ and click on 'ControlPanel.exe' -- goto 'support' tab and click 'File Status' -- you will see the file / application / etc that triggered the installation of Akamai.

    Could have been months ago, in my case it Acrobat Pro on 05/10/2011

    ReplyDelete
  182. It's JAVA!!!

    Windows Firewall blocked this for me a few days ago, too. I confirmed that I wanted it blocked since I had no idea what it was. Shortly after, I received a popup saying that there was an update for Java available... so, I tried to update. Received a communications error.. update failed.

    Just got the block from WF again, but this time I unblocked. Seconds later, JAVA needed to update... and tada.. with netsessions_win.exe unblocked, Java successfully updated.

    ReplyDelete
  183. Akamai installed itself on my system on boot yesterday. I was not looking at any stream or downloading any content, and I wasnt installing or changing anything.

    The readme in C:\Users\UserID\AppData\Local\Akamai describes the programs function "The NetSession Interface supports downloading from a central source and between peers. When peer-downloading is enabled, your computer can serve as an upload source for other computers"

    Eating your bandwidth in other words. I'll be blocking, uninstalling and looking to block the source in my hosts file to prevent it coming back!

    ReplyDelete
  184. sweet jesus people, its a false positive by winblows firewall... the tool is the adobe updater for flash and acrobat and all the other adobe products. I came here looking for info and all i found was panic

    ReplyDelete
  185. windows users
    GO to:
    Start
    Run or search
    type: config.sys
    (this is the system configuration and services).
    select the services tab and
    uncheck akamai netsession interface
    uncheck adobe acrobat update service
    and restart your system.
    this helped me and if i want to use or update either of these you can turn them back on by doing the same thing....

    ReplyDelete
  186. Dont Panic. Block it on HOSTS.
    IP:-
    akamai.com
    client.akamai.com
    213.200.111.117
    2.16.229.29
    77.67.10.134

    SIMPLEZ...

    ReplyDelete
  187. Install something silently. How clever... Uninstalled...

    ReplyDelete
  188. When I go to uninstall, it informs me that it was used to download from The Teaching Company. That's true, but that was about a year ago.

    ReplyDelete
  189. I think this is something that is commonly used - but now is being used for a rogue purpose - I just got a customers system that shows an install date of nov 5th - and is trying to contact a website blocked by trend as a maicious website - (http://64.111.211.186/cc.php....)
    also when i uninstalled it - the uninstall left about 50 entries in the registry for it - I manually cleaned all of them

    ReplyDelete
  190. this was installed on my pc when I installed the free game Need for Speed World.

    I removed the game and the akami malware went away.

    Don't try to sugar coat it as something else... it installed without your knowledge, or approval (hidden in pages of boring license agreements)

    It is Malware! Do everybody a favor and remove anything associated with it, companies need to be stopped from doing activities like this!

    ReplyDelete
  191. It's been already a few days since the message pops up, fortunatly I haven't given any permssion to connect.
    In addition an application called installer_uploader.exe with Akamai signature trys frequently a TCP connection.
    Surprisingly it has a microsoft validation: validation.sls.microsoft.com[xxx.x.x.x.]:xxxx (Since I don't know what the ip address stands for I used x instead of the real numbers).
    Any Help?

    ReplyDelete
  192. Just adding my own experience to the list.

    I am using Windows 7. My warning prompt just appeared after an update to iTunes (v 10.5.1.42). To complete the update, a reboot is required. The prompt showed up when logging back on to my profile.

    After reading all of the very helpful information posted here, I opened a "program install/uninstall manager" that I use, and, in my "recently installed programs," most notably, it shows that "Akamai Netsession Interface Service" and "iCloud" were installed. I'm inclined to believe taht iTunes/iCloud are behind my own experience.

    I also visited and reviewed the "readme.txt" file in the Akamai folder, and the date and time stamp on that README file coincides directly with the time that I was running the iTunes update. So I'm, personally, pretty comfortable in thinking mine was "caused" by Apple/iTunes/iCloud.

    I just unchecked the box to not allow unless I am on my home/office network.

    Don't you just wish they would NOTIFY you that something that they are doing will likely bring up a prompt from your firewall, a warning from security ... or something ...? So you don't have to waste an hour researching whether you should allow access to a program that you have no idea about?

    Grrrrrrrrrrrrrrr.

    ReplyDelete
  193. http://en.wikipedia.org/wiki/Akamai_Technologies
    Look at the customer section. Customers ranging from Facebook to Blizzard Entertainment.

    ReplyDelete
  194. I think it has been installed on my system after I've downloaded Need for Speed World. When uninstalling Akamai it warned me that NFS could not operate without it. Uninstalled it anyway and NFS too...

    ReplyDelete
  195. I wonder if it's possible that it has become detectable after a Windows update concerning Windows Defender. They have made many updates the last month. At least on my Win 7 computer I've had over 10 updates for Windows Defender, mostly Definition updates. I got this popup today after starting the computer with a boot-defrag.

    ReplyDelete
  196. I had the Akamai Net Session firewall warning this week, first of my work XP machine then on my home Win 7 Ultimate machine. On the work machine, it showed up after reboot to enable remote pathes by our IT manager. I have auto updates for Microsoft on my home machine. I guess that this is related to a Microsoft update.

    ReplyDelete
  197. looks like I am a little slow compared to the pack

    The Akamai Peer-to-peer client installed itself with Acrobat Pro in May. I didn't think anything of it at the time, and from their description, it sounded like a good idea. But today, my mozilla browser hung up and I saw two threads of Akamai client running in taskmanager - not good. When I stopped them, the system unhung. I was browsing a site on the Republican debates.

    Most of these web things like this hang when they can't report their status to whoever they are reporting to. My guess is that whoever was using the Akamai client API got it wrong and didn't have a good error routing in their script. They definitely were't using it for high speed downloads. Depending on your politics, you can blame either party for spying on you, or both!

    A lot of companies used to use bit-torrent for their downloads particularly in overseas locations like SA, so I suspect Akamai's idea with the P2P client was to compete. Unfortunately, it appears anyone can use their API for a lot of things that have little to nothing to do with off-loading Akamai's network.

    ReplyDelete
  198. The Akamai Netsession Client showed up on my Win7 Pro computer right after a reboot for an iTunes update.

    ReplyDelete
  199. Akamai Netsession Client was deposited on my machine by Source Forge of Germany, about a year or so back.

    They said the video player application which I got from them, needed it. That rang alarm bells with me.

    As there never has been a real need on the Internet for a so called application which "smooths" streaming and downloads. After all, there already exist plenty of Download managers and the like. Plus, there is something called "Broadband", which is ever getting faster, just as in actual fact, are computer systems themselves.

    ReplyDelete
  200. More ... I knew straight away that it was a Spook application. An application developed specifically by some national police/intellegence agency some place.

    But, I was shocked to see that it was first developed for the use of Mossad, the Israeli State's Black-ops and secret operations government group. See Wikipedia (if they still have the story on that one!)

    Interestingly, the inventor/creator of Akamai Netsessions is dead and he was only about 42 years old. Some Israeli (Mossad)IT businessman guy.

    ReplyDelete