Windows Intune Endpoint Protection

• shellext.dll is registered as an AutoPlay event handler named 'RhapsodyRipCDAudioOnArrival' with the ProgID of 'Rhapsody.AudioCDRip.3' and the action verb 'rip.

• shellext.dll added to Windows Explorer under the name 'XXX Groove GFS Context Menu Handler XXX' with a class of {6C467336-8281-4E60-8204-430CED96822D}.

• shellext.dll is loaded into Mozilla Firefox under the product name 'Office Authorization' with a plugin key of '@microsoft.com/OfficeAuthz,version=14.0' for all users of the PC.

• msseces.exe is scheduled as a task with the class '{70A48729-EDA2-4C43-BD2A-622C1FE1B158}' (runs on registration).
• MpCmdRun.exe is scheduled as a task named 'MSE' (runs weekly on Sundays at 22:52).
• MsMpEng.exe is scheduled as a task with the class '{36EFC519-FFC0-44BA-A865-06780C54FA6D}' (runs on registration).
• Setup.exe is scheduled as a task with the class '{EAC44AF3-B6F9-401D-8A78-249D0D819684}' (runs on registration).
• MsMpRes.dll is scheduled as a task named 'Microsoft-Windows-TaskScheduler_Operational_Microsoft-Windows-TaskScheduler_103'.

• MpCmdRun.exe is automatically launched at startup through a scheduled task named Microsoft Security Essentials-Startup.
• msseces.exe is automatically launched at startup through a scheduled task named MSC (5).

• NisSrv.exe runs as a service named '@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243' (NisSrv) "Helps guard against intrusion attempts targeting known and newly discovered vulnerabilities in network protocols".
• MsMpEng.exe runs as a service named 'MsMpSvc' (MsMpSvc).

• MpCmdRun.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Microsoft Malware Protection Command Line Utility' and executes as C:\Program Files\Microsoft Security Client\MpCmdRun.exe.
• msseces.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Microsoft Security Client User Interface' and executes as C:\Program Files\Microsoft Security Client\msseces.exe.
• MsMpEng.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'New startup' and executes as "C:\Program Files\Microsoft Security Client\MsMpEng.exe".

• msseces.exe is loaded once in the current user (HKCU) registry as a startup file name 'Application Restart #0' which loads as C:\Program Files\Microsoft Security Client\msseces.exe -Recover.

• msseces.exe is loaded in the all users (HKLM) registry as a startup file name 'MSC.old' which loads as "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey.
• MsMpEng.exe is loaded in the all users (HKLM) registry as a startup file name 'MsMpEng' which loads as C:\Program Files\Microsoft Security Client\MsMpEng.exe.

• msseces.exe is added as a firewall exception for 'C:\Program Files\Microsoft Security Client\msseces.exe'.
• shellext.dll is added as a firewall exception for 'C:\users\user\appdata\Local\Temp\30985.exe'.
• MsMpEng.exe is added as a firewall exception for 'C:\Program Files\Microsoft Security Client\MsMpEng.exe'.
• MpCmdRun.exe is added as a firewall exception for 'C:\Program Files\Microsoft Security Client\MpCmdRun.exe'.

Comments

Error posting comment.

'Your comment has been posted to the moderator, it should be approved shortly. Thank you for commenting!'

Pick a name