dwm.exe Proc.Injected

[khuntim]

How to tell if this is false positive and just Desktop Windows Manger? comes up Proc.Injected in C:\Windows\System32\dwm.exe

Thanks

[Curson]

Hi khuntim,

The injection might be caused for multiple reasons.
Could you please copy/paste RogueKiller full report in your next reply ?

Regards.

[khuntim]

RogueKiller V12.6.1.0 (x64) [Sep  6 2016] (Premium) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Don [Administrator]
Started from : C:\Users\Don\Desktop\RogueKiller\RogueKiller64.exe
Mode : Scan -- Date : 09/08/2016 19:14:45 (Duration : 00:11:04)

¤¤¤ Processes : 1 ¤¤¤
[Proc.Injected] dwm.exe(1880) -- C:\Windows\System32\dwm.exe[7] -> Found

¤¤¤ Registry : 4 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-3142311046-1334442230-1924139417-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://dell13.msn.com/?pc=DCJB  -> Found
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-3142311046-1334442230-1924139417-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://dell13.msn.com/?pc=DCJB  -> Found
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-3142311046-1334442230-1924139417-1000\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://dell13.msn.com/?pc=DCJB  -> Found
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-3142311046-1334442230-1924139417-1000\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://dell13.msn.com/?pc=DCJB  -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST1000DM ST1000DM003-1ER1 SCSI Disk Device +++++
--- User ---
[MBR] 65b531c3537f31e45c3211ef8a06f7f8
[BSP] c104aa894c15d2f84e580a66f07857cf : HP|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 MB
1 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 81920 | Size: 24802 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 50876416 | Size: 929026 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

[Curson]

Hi khuntim,

 Please follow the following process :

• Download Process Explorer and save it to your desktop.
  
• Click on the setup file (procexp.exe) and select Run as Administrator to start the tool.
  
• When RogueKiller goes in a loop, locate the process named dwm.exe, do a right click on it and select Create Dump > Create Full Dump...
  
• Save the dump on your desktop and compress it.
• Upload it to Dropbox, Google Drive or similar services and share the link in your next reply.

Regards.

[khuntim]

when roguekiller goes in a loop?

[Curson]

Hi khuntim,

Sorry, this case don't apply to your issue.
You can just dump the process, regardless if RogueKiller is running or not.

Regards.

[khuntim]

this comes up on every scan on every PC

[Curson]

Hi khuntim,

Could you please update RogueKiller to latest version and redo a scan ?
Then, please attach RogueKiller full report with your next reply.

Regards.

[khuntim]

using 12.12.3.0 and still get Proc.Injected C:\Windows\System32\dwm.exe on all my PCs?

[Curson]

Hi khuntim,

Could you please attach RogueKiller JSON report with your next reply ?

Regards.