System Center Endpoint Protection

• shellext.dll is registered as an AutoPlay event handler named 'DVDFabHDDecrypterOnDVDArrival' with the ProgID of 'DVDFabHDDecrypterOpen' and the action verb 'Open.

• shellext.dll added to Windows Explorer under the name 'EPP' with a class of {09A47860-11B0-4DA5-AFA5-26D86198A780}.

• shellext.dll is loaded into Mozilla Firefox under the product name 'McAfee Total Protection' with a plugin key of '@mcafee.com/MSC,version=10' for all users of the PC.

• msseces.exe is scheduled as a task with the class '{D300CC09-EC38-4DD4-B614-9579AFFC3A46}' (runs on registration).
• MpCmdRun.exe is scheduled as a task named 'Microsoft Antimalware Scan' (runs weekly on Sundays at 2:00 AM).
• MsMpEng.exe is scheduled as a task with the class '{36EFC519-FFC0-44BA-A865-06780C54FA6D}' (runs on registration).
• Setup.exe is scheduled as a task with the class '{EAC44AF3-B6F9-401D-8A78-249D0D819684}' (runs on registration).
• MsMpRes.dll is scheduled as a task named 'Microsoft-Windows-TaskScheduler_Operational_Microsoft-Windows-TaskScheduler_103'.

• MpCmdRun.exe is automatically launched at startup through a scheduled task named MS-AntiVir-Update.
• msseces.exe is automatically launched at startup through a scheduled task named MSC (2).

• NisSrv.exe runs as a service named 'Microsoft Netwerkinspectie' (NisSrv) "Biedt bescherming tegen inbraakpogingen die gericht zijn op bekende en recentelijk gevonden zwakke plekken in netwerkprotocollen".
• MsMpEng.exe runs as a service named 'Microsoft Antimalware Service' (MsMpSvc) "Helps protect users from malware and other potentially unwanted software".

• msseces.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Microsoft Security Client User Interface' and executes as C:\Program Files\Microsoft Security Client\msseces.exe.
• MpCmdRun.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Microsoft Malware Protection Command Line Utility' and executes as C:\Program Files\Microsoft Security Client\MpCmdRun.exe.
• MsMpEng.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'New startup' and executes as "C:\Program Files\Microsoft Security Client\MsMpEng.exe".

• msseces.exe is loaded once in the current user (HKCU) registry as a startup file name 'Application Restart #0' which loads as C:\Program Files\Microsoft Security Client\msseces.exe -Recover.

• msseces.exe is loaded in the all users (HKLM) registry as a startup file name 'MSC' which loads as "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey.
• MsMpEng.exe is loaded in the all users (HKLM) registry as a startup file name 'Microsoft Security' which loads as C:\Program Files\Microsoft Security Client\MsMpEng.exe.

• shellext.dll is added as a firewall exception for 'C:\Program Files2\HEWLET~1\PCCOE3~1\OVCMS~1\radexecd.exe'.
• msseces.exe is added as a firewall exception for 'C:\Program Files\Microsoft Security Client\msseces.exe'.
• MsMpEng.exe is added as a firewall exception for 'C:\Program Files\Microsoft Security Client\MsMpEng.exe'.
• Setup.exe is added as a firewall exception for 'C:\Program Files\Microsoft Security Client\setup.exe'.
• MpCmdRun.exe is added as a firewall exception for 'C:\Program Files\Microsoft Security Client\MpCmdRun.exe'.

Comments

Error posting comment.

'Your comment has been posted to the moderator, it should be approved shortly. Thank you for commenting!'

Pick a name