Adlice forum

Software feedback => RogueKiller => Topic started by: momadice on December 13, 2015, 05:42:11 PM

Title: hook - firefox.exe @ xul.dll
Post by: momadice on December 13, 2015, 05:42:11 PM

I need some help regarding a hook that Rogue Killer caught.

This is it:

[IAT:Addr(Hook.IEAT)] (firefox.exe @ xul.dll) kernel32!SetEnvironmentVariableW : Unknown @ 0x22a0728

Has anyone had this before?  Does anyone know how to fix it?

Title: Re: hook - firefox.exe @ xul.dll
Post by: Curson on December 14, 2015, 03:58:46 PM

Hi momadice,

Welcome to Adlice.com Forum.
Could you please attach the JSON report in your next reply ?

We are going to perform an extended analysis on this hook.
Please follow the following process :

• Download Process Explorer (http://live.sysinternals.com/procexp.exe) and save it to your desktop.
  
• Click on the setup file (procexp.exe) and select Run as Administrator to start the tool.
  
• Locate the process named firefox.exe, do a right click on it and select Create Dump > Create Full Dump...
  
• Save the dump on your desktop and compress it.
• Upload it to Dropbox, Google Drive or similar services and share the link in your next reply.

Regards.

Note : This thread has been moved to the "RogueKiller" section for clarity.