Unbelievable amount of hooks to eg. utorrent.exe process

jakaranda · August 2, 2011

It started about wondering why Adobe Flash consumes all the CPU and GPU resources, followed by the setting changes made to F-Secure Internet Security 2011 doesn't comply over computer reboot to downloading process explorer and finding out how redicules amounts of dll's is hooked to different programs. I am running Windows 7 64-bit SP1. Here is the HijackThis report followed by process explorer details about uTorrent.exe.

HijackThis:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:36:25, on 2.8.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
C:\Program Files (x86)\GridRepublic\boinctray.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files (x86)\F-Secure\Common\FSM32.EXE
C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
C:\Program Files (x86)\GridRepublic\gridrepublic.exe
C:\Program Files (x86)\GridRepublic\boinc.exe
C:\ProgramData\BOINC\projects\www.worldcommunitygrid.org\wcg_hpf2_rosetta_6.40_windows_intelx86
C:\ProgramData\BOINC\projects\www.worldcommunitygrid.org\wcg_faah_autodock_6.40_windows_intelx86
C:\ProgramData\BOINC\projects\www.worldcommunitygrid.org\wcg_hpf2_rosetta_6.40_windows_intelx86
C:\ProgramData\BOINC\projects\www.worldcommunitygrid.org\wcg_hpf2_rosetta_6.40_windows_intelx86
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\ProgramData\BOINC\projects\www.worldcommunitygrid.org\wcg_hcc1_img_6.42_windows_intelx86
C:\Program Files (x86)\Process explorer\procexp.exe
C:\ProgramData\BOINC\projects\www.worldcommunitygrid.org\wcg_hcc1_img_6.42_windows_intelx86
C:\ProgramData\BOINC\projects\www.worldcommunitygrid.org\wcg_hpf2_rosetta_6.40_windows_intelx86
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Windows Live ID -kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: LastPass Browser Helper Object - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPBar.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: LitmusBHO - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPBar.dll
O3 - Toolbar: Browsing Protection Toolbar - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
O4 - HKLM\..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [boincmgr] "C:\Program Files (x86)\GridRepublic\gridrepublic.exe" /a /s
O4 - HKLM\..\Run: [boinctray] "C:\Program Files (x86)\GridRepublic\boinctray.exe"
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files (x86)\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files (x86)\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'Verkkopalvelu')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'Verkkopalvelu')
O4 - Startup: Dropbox.lnk = C:\Users\kayttaja\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: LastPass - file://C:\Program Files (x86)\LastPass\context.html?cmd=lastpass
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Program Files (x86)\LastPass\context.html?cmd=fillforms
O9 - Extra button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files (x86)\LastPass\LPBar.dll
O9 - Extra button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Users\kayttaja\Desktop\PartyGammon.lnk
O9 - Extra 'Tools' menuitem: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Users\kayttaja\Desktop\PartyGammon.lnk
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {A6616B31-4860-41E2-98E3-CA7649AF172F} (Launch Control) - file:///G:/launch.ocx
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O23 - Service: @%SystemRoot%\system32\aelupsvc.dll,-1 (AeLookupSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: @%systemroot%\system32\appidsvc.dll,-100 (AppIDSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\appinfo.dll,-100 (Appinfo) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-204 (AudioEndpointBuilder) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-200 (AudioSrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\AxInstSV.dll,-103 (AxInstSV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\bdesvc.dll,-100 (BDESVC) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\bfe.dll,-1001 (BFE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qmgr.dll,-1000 (BITS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\browser.dll,-100 (Browser) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\bthserv.dll,-101 (bthserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-11 (CertPropSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\cryptsvc.dll,-1001 (CryptSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @oleres.dll,-5012 (DcomLaunch) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\defragsvc.dll,-101 (defragsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dhcpcore.dll,-100 (Dhcp) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\dnsapi.dll,-101 (Dnscache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dot3svc.dll,-1102 (dot3svc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dps.dll,-500 (DPS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\eapsvc.dll,-1 (EapHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\ehome\ehrecvr.exe,-101 (ehRecvr) - Unknown owner - C:\Windows\ehome\ehRecvr.exe
O23 - Service: @%SystemRoot%\ehome\ehsched.exe,-101 (ehSched) - Unknown owner - C:\Windows\ehome\ehsched.exe
O23 - Service: @%SystemRoot%\system32\wevtsvc.dll,-200 (eventlog) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @comres.dll,-2450 (EventSystem) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\fdPHost.dll,-100 (fdPHost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdrespub.dll,-100 (FDResPub) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\FntCache.dll,-100 (FontCache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files (x86)\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Google-päivityspalvelu (gupdate) (gupdate) - Unknown owner - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Päivitä-palvelu (gupdatem) (gupdatem) - Unknown owner - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\System32\hidserv.dll,-101 (hidserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\kmsvc.dll,-6 (hkmsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\ListSvc.dll,-100 (HomeGroupListener) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\provsvc.dll,-100 (HomeGroupProvider) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ikeext.dll,-501 (IKEEXT) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Intel(R) PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: @%systemroot%\system32\IPBusEnum.dll,-102 (IPBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\iphlpsvc.dll,-500 (iphlpsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2946 (KtmRm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\srvsvc.dll,-100 (LanmanServer) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wkssvc.dll,-100 (LanmanWorkstation) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lltdres.dll,-1 (lltdsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lmhsvc.dll,-101 (lmhosts) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-100 (MMCSS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\FirewallAPI.dll,-23090 (MpsSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\iscsidsc.dll,-5000 (MSiSCSI) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\Windows\system32\msiexec.exe
O23 - Service: @%SystemRoot%\system32\qagentrt.dll,-6 (napagent) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\netman.dll,-109 (Netman) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\netprofm.dll,-202 (netprofm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\nlasvc.dll,-1 (NlaSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\nsisvc.dll,-200 (nsi) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\pnrpsvc.dll,-8004 (p2pimsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8006 (p2psvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pcasvc.dll,-1 (PcaSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\sysWow64\perfhost.exe,-2 (PerfHost) - Unknown owner - C:\Windows\SysWow64\perfhost.exe
O23 - Service: @%systemroot%\system32\pla.dll,-500 (pla) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpnpmgr.dll,-100 (PlugPlay) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pnrpauto.dll,-8002 (PNRPAutoReg) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pnrpsvc.dll,-8000 (PNRPsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\polstore.dll,-5010 (PolicyAgent) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpo.dll,-100 (Power) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\profsvc.dll,-300 (ProfSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasauto.dll,-200 (RasAuto) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasmans.dll,-200 (RasMan) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @regsvc.dll,-1 (RemoteRegistry) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%windir%\system32\RpcEpMap.dll,-1001 (RpcEptMapper) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @oleres.dll,-5010 (RpcSs) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\System32\SCardSvr.dll,-1 (SCardSvr) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\schedsvc.dll,-100 (Schedule) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-13 (SCPolicySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sdrsvc.dll,-107 (SDRSVC) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Sens.dll,-200 (SENS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\sensrsvc.dll,-1000 (SensrSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\System32\SessEnv.dll,-1026 (SessionEnv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-12288 (ShellHWDetection) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppuinotify.dll,-103 (sppuinotify) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\ssdpsrv.dll,-100 (SSDPSRV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sstpsvc.dll,-200 (SstpSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\wiaservc.dll,-9 (stisvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\swprv.dll,-103 (swprv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sysmain.dll,-1000 (SysMain) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\TabSvc.dll,-100 (TabletInputService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tapisrv.dll,-10100 (TapiSrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tbssvc.dll,-100 (TBS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\termsrv.dll,-268 (TermService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\themeservice.dll,-8192 (Themes) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-102 (THREADORDER) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\trkwks.dll,-1 (TrkWks) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\servicing\TrustedInstaller.exe,-100 (TrustedInstaller) - Unknown owner - C:\Windows\servicing\TrustedInstaller.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - C:\Program Files (x86)\NVIDIA Corporation\System Update\UpdateCenterService.exe
O23 - Service: @%systemroot%\system32\upnphost.dll,-213 (upnphost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dwm.exe,-2000 (UxSms) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\w32time.dll,-200 (W32Time) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%systemroot%\system32\wbiosrvc.dll,-100 (WbioSrvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wcncsvc.dll,-3 (wcncsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\WcsPlugInService.dll,-200 (WcsPlugInService) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-502 (WdiServiceHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-500 (WdiSystemHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\webclnt.dll,-100 (WebClient) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wecsvc.dll,-200 (Wecsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wercplsupport.dll,-101 (wercplsupport) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wersvc.dll,-100 (WerSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%ProgramFiles%\Windows Defender\MsMpRes.dll,-103 (WinDefend) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\winhttp.dll,-100 (WinHttpAutoProxySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmisvc.dll,-205 (Winmgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wsmsvc.dll,-101 (WinRM) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wlansvc.dll,-257 (Wlansvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: @%SystemRoot%\system32\wpcsvc.dll,-100 (WPCSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wpdbusenum.dll,-100 (WPDBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wscsvc.dll,-200 (wscsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\SearchIndexer.exe,-103 (WSearch) - Unknown owner - C:\Windows\system32\SearchIndexer.exe
O23 - Service: @%systemroot%\system32\wuaueng.dll,-105 (wuauserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wudfsvc.dll,-1000 (wudfsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wwansvc.dll,-257 (WwanSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Intel(R) Extreme Tuning Utility (XTUService) - Intel Corporation - C:\Program Files (x86)\Common Files\Intel\Intel Extreme Tuning Utility\PerfTuneService.exe

--
End of file - 24824 bytes

Process explorer - uTorrent.exe:

Process    PID    CPU    Private Bytes    Working Set    Description    Company Name
System Idle Process    0        0 K    24 K        
System    4    0.06    180 K    2 648 K        
csrss.exe    504    < 0.01    3 020 K    4 408 K        
wininit.exe    580        3 600 K    4 204 K        
csrss.exe    604    0.06    12 088 K    19 540 K        
winlogon.exe    740        5 132 K    6 992 K        
explorer.exe    3672    0.01    58 268 K    92 800 K    Resurssienhallinta    Microsoft Corporation
 RAVCpl64.exe    4036        11 292 K    13 072 K    Realtek HD Audiohallinta    Realtek Semiconductor
 gridrepublic.exe    5036    0.01    9 608 K    18 728 K    GridRepublic for Windows    GridRepublic
  boinc.exe    7084    < 0.01    20 912 K    27 120 K    BOINC client    GridRepublic
   wcg_hpf2_rosetta_6.40_windows_intelx86    4648    12.12    95 576 K    88 188 K    Client Created as a collaberation between New York University (Bonneau Lab), University of Washington (Baker Lab), and IBM Corporation    New York University Center For Comparative Functional Genomics in collaboration with the University of Washington and IBM Corporation
   wcg_faah_autodock_6.40_windows_intelx86    5884    12.15    229 776 K    119 380 K    Created under grants from the National Institutes of Health National Institute of General Medical Sciences grant numbers P01 GM48870 and R01 GM069832.    The Scripps Research Institute and IBM Corporation
   wcg_c4cw_lmps_6.41_windows_x86_64    1608    12.25    93 760 K    91 788 K        
   wcg_hpf2_rosetta_6.40_windows_intelx86    3220    12.44    80 976 K    73 960 K    Client Created as a collaberation between New York University (Bonneau Lab), University of Washington (Baker Lab), and IBM Corporation    New York University Center For Comparative Functional Genomics in collaboration with the University of Washington and IBM Corporation
   wcg_hcc1_img_6.42_windows_intelx86    6868    12.46    16 972 K    16 668 K        
   wcg_hpf2_rosetta_6.40_windows_intelx86    6760    11.52    83 836 K    78 964 K    Client Created as a collaberation between New York University (Bonneau Lab), University of Washington (Baker Lab), and IBM Corporation    New York University Center For Comparative Functional Genomics in collaboration with the University of Washington and IBM Corporation
   wcg_hcc1_img_6.42_windows_intelx86    1944    12.46    36 020 K    36 180 K        
   wcg_hcc1_img_6.42_windows_intelx86    2648    11.76    35 316 K    35 364 K        
 uTorrent.exe    6708    0.68    36 936 K    45 476 K    µTorrent    BitTorrent, Inc.
 firefox.exe    1076    0.23    136 276 K    164 876 K    Firefox    Mozilla Corporation
 procexp.exe    4608        3 280 K    8 248 K    Sysinternals Process Explorer    Sysinternals - www.sysinternals.com
  procexp64.exe    3188    1.10    27 896 K    43 324 K    Sysinternals Process Explorer    Sysinternals - www.sysinternals.com
LWS.exe    680    < 0.01    8 232 K    15 480 K    Logitech Webcam Software    Logitech Inc.
boinctray.exe    608        2 488 K    5 152 K    GridRepublic System Tray for Windows    GridRepublic
IAStorIcon.exe    3956    < 0.01    28 436 K    26 704 K    IAStorIcon    Intel Corporation
jusched.exe    2688        2 508 K    5 620 K    Java(TM) Update Scheduler    Sun Microsystems, Inc.
NokiaMServer.exe    2596    0.01    22 540 K    32 040 K    Nokia M Platform    Nokia
FSM32.EXE    2684    < 0.01    20 420 K    5 236 K    F-Secure Settings and Statistics    F-Secure Corporation

Process: uTorrent.exe Pid: 6708

Name    Description    Company Name    Version
advapi32.dll    Windows 32 -pohjainen lisä-API    Microsoft Corporation    6.1.7601.17514
apisetschema.dll    ApiSet Schema DLL    Microsoft Corporation    6.1.7600.16385
atl.dll    ATL Module for Windows XP (Unicode)    Microsoft Corporation    3.5.2284.0
clbcatq.dll    COM+ Configuration Catalog    Microsoft Corporation    2001.12.8530.16385
comctl32.dll    Käyttäjäkokemus-ohjausobjektien kirjasto    Microsoft Corporation    6.10.7601.17514
comdlg32.dll    Yleisten valintaikkunoiden dll-tiedosto    Microsoft Corporation    6.1.7601.17514
credssp.dll    Credential Delegation Security Package    Microsoft Corporation    6.1.7601.17514
cryptbase.dll    Base cryptographic API DLL    Microsoft Corporation    6.1.7600.16385
cryptsp.dll    Cryptographic Service Provider API    Microsoft Corporation    6.1.7600.16385
dhcpcsvc.dll    DHCP-asiakaspalvelu    Microsoft Corporation    6.1.7600.16385
dhcpcsvc6.dll    DHCPv6-asiakas    Microsoft Corporation    6.1.7600.16385
dnsapi.dll    DNS Client API DLL    Microsoft Corporation    6.1.7601.17570
dwmapi.dll    Microsoftin työpöydän ikkunoiden hallinnan ohjelmointirajapinta    Microsoft Corporation    6.1.7600.16385
FirewallAPI.dll    Windows-palomuurin API    Microsoft Corporation    6.1.7600.16385
fsgkiapi.dll    fsgkiapi    F-Secure Corp.    9.93.16394.20
fshook32.dll    HIPS user-mode hooking module    F-Secure Corporation    3.0.171.0
fslsp.dll    F-Secure Protocol Scanner LSP    F-Secure Corporation    2.1.2000.0
fsscoepl.dll    F-Secure Spam Control plug-in for Microsoft Outlook Express®    F-Secure Corporation    1.2.7480.0
FWPUCLNT.DLL    FWP/IPsec-käyttäjätila-API    Microsoft Corporation    6.1.7601.17514
gdi32.dll    GDI Client DLL    Microsoft Corporation    6.1.7601.17514
gpapi.dll    Ryhmäkäytäntöasiakkaan API    Microsoft Corporation    6.1.7600.16385
hnetcfg.dll    Home Networking Configuration Manager    Microsoft Corporation    6.1.7600.16385
iertutil.dll    Run time utility for Internet Explorer    Microsoft Corporation    9.0.8112.16430
imm32.dll    Multi-User Windows IMM32 API Client DLL    Microsoft Corporation    6.1.7601.17514
IPHLPAPI.DLL    IP Helper API    Microsoft Corporation    6.1.7601.17514
kernel32.dll    Windows NT BASE APIn asiakas-DLL    Microsoft Corporation    6.1.7601.17617
KernelBase.dll    Windows NT BASE APIn asiakas-DLL    Microsoft Corporation    6.1.7601.17625
KernelBase.dll.mui    Windows NT BASE APIn asiakas-DLL    Microsoft Corporation    6.1.7600.16385
locale.nls            
lpk.dll    Language Pack    Microsoft Corporation    6.1.7600.16385
msctf.dll    MSCTF Server DLL    Microsoft Corporation    6.1.7600.16385
msi.dll    Windows Installer    Microsoft Corporation    5.0.7601.17514
msimg32.dll    GDIEXT Client DLL    Microsoft Corporation    6.1.7600.16385
msvcrt.dll    Windows NT CRT DLL    Microsoft Corporation    7.0.7600.16385
mswsock.dll    Microsoft Windows Sockets 2.0 -palveluntarjoaja    Microsoft Corporation    6.1.7601.17514
msxml3.dll    MSXML 3.0 SP11    Microsoft Corporation    8.110.7601.17514
msxml3r.dll    XML Resources    Microsoft Corporation    8.110.7600.16385
netshell.dll    Network Connections Shell    Microsoft Corporation    6.1.7601.17514
netutils.dll    Net Win32 API Helpers DLL    Microsoft Corporation    6.1.7601.17514
nlaapi.dll    Network Location Awareness 2    Microsoft Corporation    6.1.7601.17514
normaliz.dll    Unicode Normalization DLL    Microsoft Corporation    6.1.7600.16385
npmproxy.dll    Network List Manager Proxy    Microsoft Corporation    6.1.7600.16385
nsi.dll    NSI User-mode interface DLL    Microsoft Corporation    6.1.7600.16385
ntdll.dll    NT Layer -kirjasto (DLL)    Microsoft Corporation    6.1.7601.17514
ntdll.dll    NT Layer -kirjasto (DLL)    Microsoft Corporation    6.1.7601.17514
ole32.dll    Microsoft OLE Windowsia varten    Microsoft Corporation    6.1.7601.17514
oleaut32.dll        Microsoft Corporation    6.1.7601.17567
profapi.dll    User Profile Basic API    Microsoft Corporation    6.1.7600.16385
psapi.dll    Process Status Helper    Microsoft Corporation    6.1.7600.16385
rasadhlp.dll    Remote Access AutoDial Helper    Microsoft Corporation    6.1.7600.16385
rpcrt4.dll    Etäproseduurikutsun suoritusaika    Microsoft Corporation    6.1.7601.17514
RpcRtRemote.dll    Remote RPC Extension    Microsoft Corporation    6.1.7601.17514
rsaenh.dll    Microsoft Enhanced Cryptographic Provider    Microsoft Corporation    6.1.7600.16385
sechost.dll    Host for SCM/SDDL/LSA Lookup APIs    Microsoft Corporation    6.1.7600.16385
shell32.dll    Windows-käyttöliittymän yleinen DLL    Microsoft Corporation    6.1.7601.17514
shfolder.dll    Shell Folder Service    Microsoft Corporation    6.1.7600.16385
shlwapi.dll    Liittymän kevyt apuohjelmakirjasto    Microsoft Corporation    6.1.7601.17514
slc.dll    Ohjelmistojen käyttöoikeusasiakkaan Dll    Microsoft Corporation    6.1.7600.16385
SortDefault.nls            
ssdpapi.dll    SSDP Client API DLL    Microsoft Corporation    6.1.7600.16385
sspicli.dll    Security Support Provider Interface    Microsoft Corporation    6.1.7601.17514
StaticCache.dat            
sxs.dll    Fusion 2.5    Microsoft Corporation    6.1.7601.17514
upnp.dll    UPnP-tarkistuspisteen ohjelmointirajapinta    Microsoft Corporation    6.1.7601.17514
urlmon.dll    OLE32-laajennukset Win32:ta varten    Microsoft Corporation    9.0.8112.16430
user32.dll    Yhteiskäyttö-Windows USER API Client -DLL-kirjasto    Microsoft Corporation    6.1.7601.17514
userenv.dll    Userenv    Microsoft Corporation    6.1.7601.17514
usp10.dll    Uniscribe Unicode script processor    Microsoft Corporation    1.626.7601.17514
uTorrent.exe    µTorrent    BitTorrent, Inc.    2.2.1.25203
uxtheme.dll    Microsoft UxTheme Library    Microsoft Corporation    6.1.7600.16385
webio.dll    WWW-siirtoprotokollien API    Microsoft Corporation    6.1.7601.17514
version.dll    Version Checking and File Installation Libraries    Microsoft Corporation    6.1.7600.16385
winhttp.dll    Windowsin HTTP-palvelut    Microsoft Corporation    6.1.7601.17514
wininet.dll    Internet-laajennukset Win32:ta varten    Microsoft Corporation    9.0.8112.16421
winnsi.dll    Network Store Information RPC interface    Microsoft Corporation    6.1.7600.16385
wkscli.dll    Workstation Service Client DLL    Microsoft Corporation    6.1.7601.17514
WLIDNSP.DLL    Microsoft® Windows Live ID Namespace Provider    Microsoft Corp.    7.250.4225.0
wow64.dll    Win32 Emulation on NT64    Microsoft Corporation    6.1.7601.17625
wow64cpu.dll    AMD64 Wow64 CPU     Microsoft Corporation    6.1.7601.17625
wow64win.dll    Wow64 Console and Win32 API Logging    Microsoft Corporation    6.1.7601.17625
ws2_32.dll    Windows Socket 2.0 32-Bit DLL    Microsoft Corporation    6.1.7601.17514
wship6.dll    Winsock2 Helper DLL (TL/IPv6)    Microsoft Corporation    6.1.7600.16385
WSHTCPIP.DLL    Winsock2 Helper DLL (TL/IPv4)    Microsoft Corporation    6.1.7600.16385

And BTW, I counted 297 dll's hooked to Firefox.exe It seems like whole system is repeating itself into every running executable. I hope this isn't normal Windows 7 behaviour.

I understand that this isn't the most appropriate forum to discuss this, so I welcome any succestions for generic forums to pour over my heart.

- Jakaranda -

Firon · August 2, 2011

That DLL list for µTorrent looks pretty normal. It's almost exclusively just Windows DLLs, aside from the F-Secure stuff.

jakaranda · August 3, 2011

So false alarm. Thank you Firon.

Sign In

Unbelievable amount of hooks to eg. utorrent.exe process

Recommended Posts

jakaranda

Link to comment

Share on other sites

Firon

Link to comment

Share on other sites

jakaranda

Link to comment

Share on other sites

Archived

Browse

Activity