Was setting up my new laptop and decided to install an old friend of mine--daemon tools. Apparently sometime between when I last worked in IT and today DT went to shit and now installs malware. I didn't get any accept/decline requests during installation and I am very careful about fully reading installers options. Allegedly DT will ask for permission before installing PUPS but once a program has taken the step of offering malware it loses all credibility and trust so who knows what the hell it installed without permission. I ran RogueKiller to be certain I was clean and it returned several IAT Hooks that were not present several days ago. However, I have installed several low level security measures in the meantime--MWB, Bitdefender Pro, WinPatrol, and several on-demand scanners.
Unfortunately I have been out of IT entirely for the better half of a decade and can no longer parse these logs with any sort of certainty. Would sincerely appreciate any assistance with these HJT and RK logs. Anyone see anything really shady here?
&&&&&&&&&&&&&&&&&&&&&&RogueKiller&&&&&&&&&&&&&&&&&&
RogueKiller V10.10.6.0 (x64) [Sep 21 2015] by Adlice Software
mail :
http://www.adlice.com/contact/Feedback :
http://forum.adlice.comWebsite :
http://www.adlice.com/software/roguekiller/Blog :
http://www.adlice.comOperating System : Windows 10 (10.0.10240) 64 bits version
Started in : Normal mode
User : user [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller.exe
Mode : Scan -- Date : 09/22/2015 12:45:07
¤¤¤ Processes : 0 ¤¤¤
¤¤¤ Registry : 0 ¤¤¤
¤¤¤ Tasks : 0 ¤¤¤
¤¤¤ Files : 0 ¤¤¤
¤¤¤ Hosts File : 0 [Too big!] ¤¤¤
¤¤¤ Antirootkit : 40 (Driver: Loaded) ¤¤¤
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtMapViewOfSection : Unknown @ 0x75941501 (jmp 0xfde686a1|jmp 0xffffef9a|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtUnmapViewOfSection : Unknown @ 0x75941599 (jmp 0xfde68719|jmp 0xffffef02|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtSuspendThread : Unknown @ 0x75941f19 (jmp 0xfde67939|jmp 0xffffe582|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtSetContextThread : Unknown @ 0x75941b89 (jmp 0xfde678b9|jmp 0xffffe912|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtProtectVirtualMemory : Unknown @ 0x759443e9 (jmp 0xfde6b309|jmp 0xffffc0b2|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - RtlEqualSid : Unknown @ 0x75943a69 (jmp 0xfde87759|jmp 0xffffca32|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtQueryInformationToken : Unknown @ 0x759439d1 (jmp 0xfde6abe1|jmp 0xffffcaca|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtTerminateProcess : Unknown @ 0x75942931 (jmp 0xfde69a91|jmp 0xffffdb6a|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtCreateSection : Unknown @ 0x75945229 (jmp 0xfde6c1a9|jmp 0xffffb272|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtSetInformationProcess : Unknown @ 0x759429c9 (jmp 0xfde69c29|jmp 0xffffdad2|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtOpenProcessToken : Unknown @ 0x75943939 (jmp 0xfde69c19|jmp 0xffffcb62|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtSetSystemInformation : Unknown @ 0x75942af9 (jmp 0xfde68639|jmp 0xffffd9a2|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtSetValueKey : Unknown @ 0x75945359 (jmp 0xfde6c179|jmp 0xffffb142|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) ntdll.dll - NtOpenFile : Unknown @ 0x75943fc1 (jmp 0xfde6b0b1|jmp 0xffffc4da|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) KERNELBASE.dll - CreateProcessInternalA : Unknown @ 0x75944c39 (jmp 0x23e4c9|jmp 0xffffb862|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNEL32.DLL) KERNELBASE.dll - CreateProcessInternalW : Unknown @ 0x75941a59 (jmp 0x2c3bc9|jmp 0xffffea42|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNELBASE.dll) ntdll.dll - NtDuplicateObject : Unknown @ 0x75941d51 (jmp 0xfde68db1|jmp 0xffffe74a|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNELBASE.dll) ntdll.dll - NtAdjustPrivilegesToken : Unknown @ 0x75942fb9 (jmp 0xfde69fc9|jmp 0xffffd4e2|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNELBASE.dll) ntdll.dll - NtWriteVirtualMemory : Unknown @ 0x75941af1 (jmp 0xfde68b71|jmp 0xffffe9aa|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNELBASE.dll) ntdll.dll - NtCreateThreadEx : Unknown @ 0x759417f9 (jmp 0xfde680e9|jmp 0xffffeca2|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNELBASE.dll) ntdll.dll - NtQueueApcThread : Unknown @ 0x75941cb9 (jmp 0xfde68c89|jmp 0xffffe7e2|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNELBASE.dll) ntdll.dll - NtCreateMutant : Unknown @ 0x759450f9 (jmp 0xfde6baa9|jmp 0xffffb3a2|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNELBASE.dll) ntdll.dll - NtOpenProcess : Unknown @ 0x75941c21 (jmp 0xfde68de1|jmp 0xffffe87a|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNELBASE.dll) ntdll.dll - NtOpenSection : Unknown @ 0x75945191 (jmp 0xfde6c241|jmp 0xffffb30a|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ KERNELBASE.dll) ntdll.dll - RtlCreateProcessParametersEx : Unknown @ 0x75942769 (jmp 0xfdeadca9|jmp 0xffffdd32|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ avcuf32.dll) KERNEL32.DLL - CreateToolhelp32Snapshot : Unknown @ 0x75941e81 (jmp 0x98a971|jmp 0xffffe61a|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ nss3.dll) MSVCR120.dll - fopen : Unknown @ 0x759448a9 (jmp 0x2122ae5|jmp 0xffffbbf2|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ WINMM.dll) USER32.dll - PostMessageA : Unknown @ 0x75943e91 (jmp 0xfe9c7071|jmp 0xffffc60a|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ WINMM.dll) USER32.dll - PostMessageW : Unknown @ 0x75943f29 (jmp 0xfe9d8809|jmp 0xffffc572|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ WINMM.dll) USER32.dll - GetMessageA : Unknown @ 0x75943d61 (jmp 0xfe9c7281|jmp 0xffffc73a|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ USER32.dll) ntdll.dll - NtVdmControl : Unknown @ 0x75943c31 (jmp 0xfde69531|jmp 0xffffc86a|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ WS2_32.dll) ntdll.dll - NtLoadDriver : Unknown @ 0x75942a61 (jmp 0xfde68f31|jmp 0xffffda3a|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ MSCTF.dll) USER32.dll - GetMessageW : Unknown @ 0x75943df9 (jmp 0xfe9c0bc9|jmp 0xffffc6a2|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ MSCTF.dll) USER32.dll - SetWinEventHook : Unknown @ 0x75942049 (jmp 0xfe9d44c9|jmp 0xffffe452|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ xul.dll) USER32.dll - SetWindowsHookExW : Unknown @ 0x759416c9 (jmp 0xfe9d3db9|jmp 0xffffedd2|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ xul.dll) ADVAPI32.dll - CryptAcquireContextW : Unknown @ 0x75943349 (jmp 0xfdf32c19|jmp 0xffffd152|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ xul.dll) ADVAPI32.dll - CryptAcquireContextA : Unknown @ 0x759432b1 (jmp 0xfdf326b1|jmp 0xffffd1ea|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ npcomm.dll) WS2_32.dll - WSASend : Unknown @ 0x75944189 (jmp 0x8b6c59|jmp 0xffffc312|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ npcomm.dll) KERNEL32.DLL - GetStartupInfoA : Unknown @ 0x75943b99 (jmp 0x99a469|jmp 0xffffc902|call 0x1fe)
[IAT:Inl(Hook.IEAT)] (firefox.exe @ IServConfig.dll) ADVAPI32.dll - CryptImportKey : Unknown @ 0x75943809 (jmp 0xfdf33f79|jmp 0xffffcc92|call 0x1fe)
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD10SPCX-08HWST0 +++++
--- User ---
[MBR] 2c419551e65d4996dc34bb3c9864b0df
[BSP] 8a3a1ad4cb4e03f02a80c700c5a508a6 : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 2048 | Size: 1000 MB
1 - [MAN-MOUNT] | Offset (sectors): 2050048 | Size: 260 MB
2 - [MAN-MOUNT] | Offset (sectors): 2582528 | Size: 128 MB
3 - | Offset (sectors): 2844672 | Size: 937818 MB
4 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 1923495936 | Size: 14662 MB
User = LL1 ... OK
User = LL2 ... OK
+++++ PhysicalDrive1: SanDisk SSD U110 16GB +++++
Error reading User MBR! NOT VALID!
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! NOT VALID!
&&&&&&&&&&&HIJACKTHIS&&&&&&&&&&&&&&&&&&&&&
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 1:05:46 PM, on 9/22/2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.10240.16412)
FIREFOX: 40.0.3 (x86 en-US)
Boot mode: Normal
Running processes:
C:\Program Files\Bitdefender\Bitdefender 2016\Antispam32\bdwtxapps.exe
C:\internet\browsers\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\eM Client\MailClient.exe
C:\admin\security\toolbox\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/p/?LinkId=255141R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/p/?LinkId=255141R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/p/?LinkId=255141R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: how to make the internet not suck (as much)
O1 - Hosts: 255.255.255.255 broadcasthost
O1 - Hosts: ::1 localhost
O2 - BHO: Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2016\Antispam32\pmbxie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll
O3 - Toolbar: Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2016\Antispam32\pmbxie.dll
O4 - HKCU\..\Run: [WinPatrol] C:\admin\security\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [Bitdefender Wallet Agent] "C:\Program Files\Bitdefender\Bitdefender 2016\bdwtxag.exe"
O4 - HKCU\..\Run: [eM Client] "C:\Program Files (x86)\eM Client\MailClient.exe" /startup
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: ExpressCache - Condusiv Technologies - C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: @oem41.inf,%ibm.svcDesc0%;Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService2.0.0.0) - Unknown owner - C:\WINDOWS\system32\igfxCUIService.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\admin\security\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\admin\security\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\System32\ngcsvc.dll,-100 (NgcSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\windows\system32\nvvsvc.exe (file missing)
O23 - Service: O2FLASH - Unknown owner - C:\WINDOWS\System32\drivers\o2flash.exe (file missing)
O23 - Service: Product Agent Service (ProductAgentService) - Bitdefender - C:\Program Files\Bitdefender Agent\ProductAgentService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: Realtek Audio Service (RtkAudioService) - Realtek Semiconductor - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SynTPEnh Caller Service (SynTPEnhService) - Synaptics Incorporated - C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Unknown owner - C:\WINDOWS\System32\TPHDEXLG64.exe (file missing)
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: Bitdefender Desktop Update Service (UPDATESRV) - Bitdefender - C:\Program Files\Bitdefender\Bitdefender 2016\updatesrv.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: Bitdefender Virus Shield (VSSERV) - Bitdefender - C:\Program Files\Bitdefender\Bitdefender 2016\vsserv.exe
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 10274 bytes
Thanks!
Topic: IAT Hooks (Read 6399 times)
