Radix rootkit scan result

Discussion in 'malware problems & news' started by crykid, Mar 31, 2012.

Thread Status:
Not open for further replies.
  1. crykid

    crykid Registered Member

    Joined:
    Mar 31, 2012
    Posts:
    6
    Radix rootkit found this

    C:\WINDOWS\system32\services.exe:ADVAPI32.dll: services.exe:CreateProcessAsUserW --[HOOKED]--

    Could this be malicious, or is it normal for ADVAPI32 to be hooked by legitimate programs?

    Thank you.
     
    crykid, Mar 31, 2012
    #1
  2. fax

    fax Registered Member

    Joined:
    May 30, 2005
    Posts:
    3,904
    Location:
    localhost
    fax, Apr 1, 2012
    #2
  3. TheKid7

    TheKid7 Registered Member

    Joined:
    Jul 22, 2006
    Posts:
    3,585
    You could upload the file to VirusTotal.
     
    TheKid7, Apr 1, 2012
    #3
  4. crykid

    crykid Registered Member

    Joined:
    Mar 31, 2012
    Posts:
    6
    It is, but does it mean that im protected. Because it doesnt matter if the file is valid, that valid file is being hooked by something that could be malicious, right? Im not a security expert so you could explain that for me.
     
    crykid, Apr 1, 2012
    #4
  5. fax

    fax Registered Member

    Joined:
    May 30, 2005
    Posts:
    3,904
    Location:
    localhost
    That hooking is normal... the DLL is overseeing the shutdown/restart of the system (or abort), start/stop/create a windows service, manage user accounts.

    Not yet convinced? Upload to virustotal... not yet convinced? Then contact Radix support, they will explain you the false positive.
     
    fax, Apr 1, 2012
    #5
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...