My Roguekiller scan

[valker04]

Hello! First of all I want to warn you that my English isn't perfect, so it can be a little difficult for you to understand me. Sorry for that!

Here is my scan, there is nothing wrong except for a few orange results in "Antirootkit" tab. Maybe I'm overreactive, but I'm kinda worried.



RogueKiller V9.2.8.0 (x64) [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8 (6.2.9200 ) 64 bits version
Started in : Normal mode
User : Kaszalubabob [Admin rights]
Mode : Scan -- Date : 08/16/2014  16:13:22

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 ¤¤¤

¤¤¤ Antirootkit : 36 (Driver: LOADED) ¤¤¤
[EAT:Addr] (explorer.exe) acppage.dll - BiChangeApplicationStateForPackageName : C:\Windows\System32\twinapi.dll @ 0x7fb8538ab80
[EAT:Addr] (explorer.exe) acppage.dll - BiChangeSessionState : C:\Windows\System32\twinapi.dll @ 0x7fb853a53d8
[EAT:Addr] (explorer.exe) acppage.dll - BiNotifyNewSession : C:\Windows\System32\twinapi.dll @ 0x7fb853a6f0c
[EAT:Addr] (explorer.exe) acppage.dll - BiPtActivateWorkItem : C:\Windows\System32\twinapi.dll @ 0x7fb853fbce0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtAssociateActivationProxy : C:\Windows\System32\twinapi.dll @ 0x7fb853aa7ec
[EAT:Addr] (explorer.exe) acppage.dll - BiPtAssociateApplicationExtensionClass : C:\Windows\System32\twinapi.dll @ 0x7fb853fbbd0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtCreateEventForPackageName : C:\Windows\System32\twinapi.dll @ 0x7fb853fbac0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtDeleteEvent : C:\Windows\System32\twinapi.dll @ 0x7fb853fba50
[EAT:Addr] (explorer.exe) acppage.dll - BiPtDisassociateWorkItem : C:\Windows\System32\twinapi.dll @ 0x7fb853fb9b0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtEnumerateBrokeredEvents : C:\Windows\System32\twinapi.dll @ 0x7fb853a6a70
[EAT:Addr] (explorer.exe) acppage.dll - BiPtEnumerateWorkItemsForPackageName : C:\Windows\System32\twinapi.dll @ 0x7fb853fb8c0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtFreeMemory : C:\Windows\System32\twinapi.dll @ 0x7fb85385fe0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtQueryBrokeredEvent : C:\Windows\System32\twinapi.dll @ 0x7fb85385df0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtQuerySystemStateBroadcastChannels : C:\Windows\System32\twinapi.dll @ 0x7fb853a6a0c
[EAT:Addr] (explorer.exe) acppage.dll - BiPtQueryWorkItem : C:\Windows\System32\twinapi.dll @ 0x7fb853fb804
[EAT:Addr] (explorer.exe) acppage.dll - BiPtSignalEvent : C:\Windows\System32\twinapi.dll @ 0x7fb853fb738
[EAT:Addr] (explorer.exe) acppage.dll - BiPtSignalMultipleEvents : C:\Windows\System32\twinapi.dll @ 0x7fb853fb660
[EAT:Addr] (explorer.exe) acppage.dll - BiResetActiveSessionForPackage : C:\Windows\System32\twinapi.dll @ 0x7fb853fb57c
[EAT:Addr] (explorer.exe) acppage.dll - BiSetActiveSessionForPackage : C:\Windows\System32\twinapi.dll @ 0x7fb853fb4e0
[EAT:Addr] (explorer.exe) acppage.dll - BiUpdateLockScreenApplications : C:\Windows\System32\twinapi.dll @ 0x7fb853fb430
[EAT:Addr] (explorer.exe) acppage.dll - DllCanUnloadNow : C:\Windows\System32\twinapi.dll @ 0x7fb85381340
[EAT:Addr] (explorer.exe) acppage.dll - DllGetActivationFactory : C:\Windows\System32\twinapi.dll @ 0x7fb85382f60
[EAT:Addr] (explorer.exe) acppage.dll - DllGetClassObject : C:\Windows\System32\twinapi.dll @ 0x7fb85382110
[EAT:Addr] (explorer.exe) acppage.dll - PsmBlockAppStateChangeCompletion : C:\Windows\System32\twinapi.dll @ 0x7fb853fbdd4
[EAT:Addr] (explorer.exe) acppage.dll - PsmIsProcessInApplication : C:\Windows\System32\twinapi.dll @ 0x7fb85397d60
[EAT:Addr] (explorer.exe) acppage.dll - PsmQueryApplicationInformation : C:\Windows\System32\twinapi.dll @ 0x7fb853873f0
[EAT:Addr] (explorer.exe) acppage.dll - PsmQueryApplicationList : C:\Windows\System32\twinapi.dll @ 0x7fb85382770
[EAT:Addr] (explorer.exe) acppage.dll - PsmQueryCurrentAppState : C:\Windows\System32\twinapi.dll @ 0x7fb853fbd70
[EAT:Addr] (explorer.exe) acppage.dll - PsmQueryProcessList : C:\Windows\System32\twinapi.dll @ 0x7fb853824f0
[EAT:Addr] (explorer.exe) acppage.dll - PsmRegisterAppStateChangeNotification : C:\Windows\System32\twinapi.dll @ 0x7fb8538cf00
[EAT:Addr] (explorer.exe) acppage.dll - PsmRegisterApplicationNotification : C:\Windows\System32\twinapi.dll @ 0x7fb853871e0
[EAT:Addr] (explorer.exe) acppage.dll - PsmSetApplicationState : C:\Windows\System32\twinapi.dll @ 0x7fb8538a870
[EAT:Addr] (explorer.exe) acppage.dll - PsmShutdownApplication : C:\Windows\System32\twinapi.dll @ 0x7fb853fbec0
[EAT:Addr] (explorer.exe) acppage.dll - PsmUnblockAppStateChangeCompletion : C:\Windows\System32\twinapi.dll @ 0x7fb853fbe0c
[EAT:Addr] (explorer.exe) acppage.dll - PsmUnregisterAppStateChangeNotification : C:\Windows\System32\twinapi.dll @ 0x7fb85390a68
[EAT:Addr] (explorer.exe) acppage.dll - PsmWaitForAppResume : C:\Windows\System32\twinapi.dll @ 0x7fb853fbe5c

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HD501LJ ATA Device +++++
--- User ---
[MBR] 890fdc9d64343530439ce0349d6a7c9d
[BSP] e0a710e9c751fb1451f92f32ee7c38a2 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 476929 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: KINGSTON SV300S37A120G ATA Device +++++
--- User ---
[MBR] 4e9a1e20b9c240e4e62b8c78bb7fe2f0
[BSP] bc44478ef9e3b2e0bac52d91816d5736 : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 114470 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_DEL_08152014_210142.log - RKreport_DEL_08152014_210650.log - RKreport_SCN_07202014_202400.log - RKreport_SCN_07202014_203454.log
RKreport_SCN_07202014_214400.log - RKreport_SCN_08032014_195001.log - RKreport_SCN_08042014_162926.log - RKreport_SCN_08042014_165355.log
RKreport_SCN_08042014_201107.log - RKreport_SCN_08152014_210025.log - RKreport_SCN_08152014_210342.log - RKreport_SCN_08162014_133712.log
RKreport_SCN_08162014_155620.log



I ran a scan with malwarebytes and MBAR, but it found nothing. Same thing with Avast, obviously. Should I be worried or am I perfectly fine?

[valker04]

Hey, I just ran another scan and it seems that these suspicious results... disappeared. Now all of my results in the "antirootkit" tab are green. I'm not sure what happened, here is the report.

RogueKiller V9.2.8.0 (x64) [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8 (6.2.9200 ) 64 bits version
Started in : Normal mode
User : Kaszalubabob [Admin rights]
Mode : Scan -- Date : 08/18/2014  21:39:59

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: LOADED) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HD501LJ ATA Device +++++
--- User ---
[MBR] 890fdc9d64343530439ce0349d6a7c9d
[BSP] e0a710e9c751fb1451f92f32ee7c38a2 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 476929 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: KINGSTON SV300S37A120G ATA Device +++++
--- User ---
[MBR] 4e9a1e20b9c240e4e62b8c78bb7fe2f0
[BSP] bc44478ef9e3b2e0bac52d91816d5736 : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 114470 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_DEL_08152014_210142.log - RKreport_DEL_08152014_210650.log - RKreport_SCN_07202014_202400.log - RKreport_SCN_07202014_203454.log
RKreport_SCN_07202014_214400.log - RKreport_SCN_08032014_195001.log - RKreport_SCN_08042014_162926.log - RKreport_SCN_08042014_165355.log
RKreport_SCN_08042014_201107.log - RKreport_SCN_08152014_210025.log - RKreport_SCN_08152014_210342.log - RKreport_SCN_08162014_133712.log
RKreport_SCN_08162014_155620.log - RKreport_SCN_08162014_161322.log - RKreport_SCN_08182014_213312.log - RKreport_SCN_08182014_213708.log

[Tigzy]

Hello
Sometimes the hooks are set dynamically

Looks like twinapi is legit.
http://systemexplorer.net/fr/file-database/file/twinapi-dll

[valker04]

Thank you!