Many Windows users suddenly encounter a User Account Control (UAC) popup asking permission to run update_server Setup. Since the publisher name is displayed in Chinese, users often suspect malware or a hacking attempt.

From the screenshots you shared, Windows is displaying:

• Program: update_server Setup
• Executable: update_server.exe
• Publisher: 杭州萤石软件有限公司
• Certificate Authority: GlobalSign GCC R45 CodeSigning CA 2020
• Location: C:\Users\Shambhu\shipin7_update_temp\update_server.exe
• Command Line: /VERYSILENT /SP-

The important question is:

Is this malware, or is it a legitimate software update?

Let's understand everything in detail.

What Does This Error Mean?

This is not actually an error.

Windows User Account Control (UAC) is informing you that a program wants Administrator privileges to install or update software.

Whenever software wants to:

• Install drivers
• Update itself
• Modify Windows files
• Install services
• Change registry settings

Windows shows this prompt.

Understanding Every Part of the Popup

1. update_server Setup

This is simply the installer name.

Many software vendors use generic updater names such as:

• update.exe
• updater.exe
• update_server.exe

It does not automatically mean malware.

2. Verified Publisher

The popup shows

杭州萤石软件有限公司

This translates to

Hangzhou Ezviz Software Co., Ltd.

EZVIZ is a well-known company that manufactures:

• CCTV Cameras
• Smart Home Cameras
• Video Doorbells
• DVR/NVR Systems
• Cloud Security Solutions

They are associated with Hikvision's ecosystem.

3. GlobalSign Certificate

The certificate is issued by

GlobalSign GCC R45 CodeSigning CA 2020

This means

• The software is digitally signed.
• Windows has verified the signature.
• The file has not been modified after signing.

A valid certificate does not guarantee the software is harmless, but it significantly increases confidence that it came from the stated publisher.

4. Valid From

19-Dec-2025
to
20-Dec-2026

The certificate is currently valid.

That is a good sign.

5. Program Location

C:\Users\Shambhu\shipin7_update_temp\

Notice the folder:

shipin7_update_temp

"Shipin" (视频) means video in Chinese.

This strongly suggests the updater belongs to CCTV or video surveillance software.

6. Command Line

/VERYSILENT
/SP-

These are Inno Setup installer parameters.

/VERYSILENT

Runs without showing installation screens.

/SP-

Skips the initial confirmation prompt.

Many legitimate software updates use these options.

Is It Malware?

Not necessarily.

Based on your screenshots:

✔ Digitally signed

✔ Valid certificate

✔ GlobalSign certificate

✔ Verified publisher

✔ Typical updater location

All these indicate that this is most likely a legitimate updater.

However,

If you are not using any EZVIZ, Hikvision, or Chinese surveillance software, then it deserves investigation.

Common Reasons This Popup Appears

Automatic software update

The installed application is checking for updates.

Windows Startup

The updater is scheduled to run during startup.

Scheduled Task

Some applications create scheduled tasks that launch update_server.exe.

Background Service

The application service may automatically download updates.

User manually launched the software

Opening the application can trigger the updater.

How to Verify Whether It Is Safe

Step 1

Right-click

update_server.exe

Choose

Properties

Digital Signatures

Confirm

• Publisher
• Certificate
• Timestamp

Step 2

Check file hash

Open PowerShell

Get-FileHash "C:\Users\Shambhu\shipin7_update_temp\update_server.exe"

Compare it with the vendor's official file if available.

Step 3

Upload to VirusTotal

Scan the executable.

If almost all antivirus engines report it as clean, it is likely safe.

Step 4

Check Installed Programs

Look for software such as

• EZVIZ
• Hikvision
• IVMS
• CCTV Client
• Video Surveillance
• Camera Viewer

Step 5

Check Startup

Open

Task Manager

Startup

Look for

update_server.exe

Step 6

Check Task Scheduler

taskschd.msc

Search for

• Update
• EZVIZ
• Hikvision
• Shipin

Why Does Windows Ask Every Time?

Possible reasons:

• Installer always requests Administrator rights
• Update service isn't installed
• UAC is enabled
• Auto-update requires elevated permissions

When Should You Click "Yes"?

Click Yes if:

✔ You intentionally installed the software.

✔ You use EZVIZ or Hikvision products.

✔ The certificate is valid.

✔ The file location matches the software installation.

When Should You Click "No"?

Choose No if:

• You don't recognize the software.
• The publisher is Unknown.
• The signature is invalid.
• The popup appears repeatedly without any related software installed.
• Antivirus reports the file as malicious.

Advanced Investigation

Process Explorer

Check

• Parent Process
• Child Process
• Loaded DLLs

Autoruns

Microsoft Sysinternals Autoruns can show

• Startup entries
• Scheduled Tasks
• Services
• Drivers

Event Viewer

Look for

Application Logs
Windows Logs
Security Logs

Process Monitor

Monitor

• Registry changes
• File creation
• Network activity

Possible Causes

Solutions

Solution 1

Update the application manually.

Solution 2

Download the latest installer directly from the software vendor.

Solution 3

Uninstall and reinstall the application.

Solution 4

Disable automatic updates if allowed by the software.

Solution 5

Run a complete antivirus scan.

Solution 6

Verify the digital signature.

Solution 7

Remove orphaned startup entries if the software has already been uninstalled.

Security Recommendations

• Keep Windows updated.
• Install software only from trusted sources.
• Never bypass UAC without understanding the prompt.
• Verify digital signatures.
• Use reputable antivirus software.
• Periodically review Startup Apps and Scheduled Tasks.

Conclusion

The screenshots indicate a Windows User Account Control (UAC) prompt for a software updater named update_server.exe. The executable is digitally signed by Hangzhou Ezviz Software Co., Ltd. using a valid GlobalSign code-signing certificate, which is a positive indicator of authenticity. If you have installed EZVIZ, Hikvision, or related surveillance software, this prompt is most likely a legitimate software update.

However, if you do not have any such software installed or the prompt appears unexpectedly and repeatedly, you should investigate the executable further by checking its digital signature, scanning it with your antivirus or VirusTotal, reviewing startup entries and scheduled tasks, and verifying whether it belongs to a known application before allowing it to make changes to your system.

Frequently Asked Questions (FAQ)

Q1. Is this a Windows error?

No. It is a standard Windows User Account Control (UAC) security prompt.

Q2. Does a verified publisher mean the file is 100% safe?

No. It confirms the file is digitally signed by the stated publisher and has not been altered after signing, but you should still ensure it is expected software.

Q3. Why is the publisher name shown in Chinese?

Because the software publisher is a Chinese company. Windows displays the certificate's registered legal name.

Q4. What does /VERYSILENT mean?

It instructs the installer to perform the installation without displaying the normal setup wizard.

Q5. What does /SP- mean?

It is an Inno Setup switch that skips the initial startup prompt before installation.

Q6. Can malware have a digital signature?

Yes. Although less common, malware authors can obtain or steal code-signing certificates. Always verify the file's origin and reputation.

Q7. How can I stop this popup from appearing?

Update, repair, or uninstall the associated software, or disable its automatic updater if the software provides that option.

Q8. Should I delete update_server.exe?

Not unless you have confirmed it is unnecessary or malicious. Deleting updater files without understanding their purpose may break software updates.

Q9. Why does Windows require administrator permission?

The installer needs elevated privileges to modify protected system locations, install services, or update program files.

Q10. What should I do if I don't recognize this software?

Click No, identify which application installed it, scan the executable with your antivirus, and review startup items and scheduled tasks before allowing it to run.