Radix rootkit scan result

[crykid]

Radix rootkit found this

C:\WINDOWS\system32\services.exe:ADVAPI32.dll: services.exe:CreateProcessAsUserW --[HOOKED]--

Could this be malicious, or is it normal for ADVAPI32 to be hooked by legitimate programs?

Thank you.

[fax]

Its legit and from MS and normal that hook at that level:
http://en.wikipedia.org/wiki/Windows_API

Check that the file is MS digitally signed and not broken. Done...

[TheKid7]

You could upload the file to VirusTotal.

[crykid]

Originally Posted by fax

Its legit and from MS and normal that hook at that level:
http://en.wikipedia.org/wiki/Windows_API

Check that the file is MS digitally signed and not broken. Done...

It is, but does it mean that im protected. Because it doesnt matter if the file is valid, that valid file is being hooked by something that could be malicious, right? Im not a security expert so you could explain that for me.

[fax]

That hooking is normal... the DLL is overseeing the shutdown/restart of the system (or abort), start/stop/create a windows service, manage user accounts.

Not yet convinced? Upload to virustotal... not yet convinced? Then contact Radix support, they will explain you the false positive.