Microsoft Forefront Endpoint Protection

• shellext.dll is registered as an AutoPlay event handler named 'DVDFabHDDecrypterOnDVDArrival' with the ProgID of 'DVDFabHDDecrypterOpen' and the action verb 'Open.

• shellext.dll added to Windows Explorer under the name 'OpenWithCtxMenuExt' with a class of {BC654325-1273-C2A9-2B7C-45D29BCE68FB}.

• shellext.dll is loaded into Mozilla Firefox under the product name 'Microsoft SharePoint Plug-in for Firefox' with a plugin key of '@microsoft.com/SharePoint,version=14.0' for all users of the PC.

• msseces.exe is scheduled as a task with the class '{6FA94EF8-7B88-4C31-9AF5-D831F612AF54}' (runs on registration).
• MpCmdRun.exe is scheduled as a task named 'Microsoft Security Essentials Scan' (runs daily at 11:00 PM).
• MsMpEng.exe is scheduled as a task with the class '{36EFC519-FFC0-44BA-A865-06780C54FA6D}' (runs on registration).
• Setup.exe is scheduled as a task with the class '{EAC44AF3-B6F9-401D-8A78-249D0D819684}' (runs on registration).
• MsMpRes.dll is scheduled as a task named 'Microsoft-Windows-TaskScheduler_Operational_Microsoft-Windows-TaskScheduler_103'.

• msseces.exe is automatically launched at startup through a scheduled task named 5.
• MpCmdRun.exe is automatically launched at startup through a scheduled task named MS-AntiVir-Update.

• NisSrv.exe runs as a service named 'Microsoft Netwerkinspectie' (NisSrv) "Biedt bescherming tegen inbraakpogingen die gericht zijn op bekende en recentelijk gevonden zwakke plekken in netwerkprotocollen".
• MsMpEng.exe runs as a service named 'Microsoft Antimalware Service' (MsMpSvc) "Helps protect users from malware and other potentially unwanted software".

• msseces.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Microsoft Security Client User Interface' and executes as C:\Program Files\Microsoft Security Client\msseces.exe.
• MpCmdRun.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Microsoft Malware Protection Command Line Utility' and executes as C:\Program Files\Microsoft Security Client\MpCmdRun.exe.
• MsMpEng.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'New startup' and executes as "C:\Program Files\Microsoft Security Client\MsMpEng.exe".

• msseces.exe is loaded once in the current user (HKCU) registry as a startup file name 'Application Restart #1' which loads as C:\Program Files\Microsoft Security Client\msseces.exe -Recover.

• msseces.exe is loaded in the all users (HKLM) registry as a startup file name 'msseces.exe' which loads as "C:\Program Files\Microsoft Security Client\msseces.exe".
• MsMpEng.exe is loaded in the all users (HKLM) registry as a startup file name 'Microsoft Security' which loads as C:\Program Files\Microsoft Security Client\MsMpEng.exe.

• shellext.dll is added as a firewall exception for 'C:\Program Files2\HEWLET~1\PCCOE3~1\OVCMS~1\radexecd.exe'.
• msseces.exe is added as a firewall exception for 'C:\Program Files\Microsoft Security Client\msseces.exe'.
• MsMpEng.exe is added as a firewall exception for 'C:\Program Files\Microsoft Security Client\MsMpEng.exe'.
• Setup.exe is added as a firewall exception for 'C:\Program Files\Microsoft Security Client\setup.exe'.
• MpCmdRun.exe is added as a firewall exception for 'C:\Program Files\Microsoft Security Client\MpCmdRun.exe'.

Comments

Error posting comment.

'Your comment has been posted to the moderator, it should be approved shortly. Thank you for commenting!'

Pick a name