Unknown hook

Viruses and worms
1

I ran rogue killer today and found this unknown hook

RogueKiller V8.7.1 [Oct 3 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : PatricK [Admin rights]
Mode : Scan – Date : 10/07/2013 08:46:22
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[HJ POL][PUM] HKCU[…]\System : DisableRegistryTools (0) → FOUND
[HJ POL][PUM] HKLM[…]\System : DisableRegistryTools (0) → FOUND
[HJ DESK][PUM] HKCU[…]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) → FOUND
[HJ DESK][PUM] HKCU[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) → FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤
[Inline] EAT @explorer.exe (?s_pClassInfo@Edit@DirectUI@@0PAUIClassInfo@2@A) : DUI70.dll → HOOKED (Unknown @ 0x4C40C744)

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
→ %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\.\PHYSICALDRIVE0 @ IDE) (Standard disk drives) - WDC WD5000AADS-67S9B1 ATA Device +++++
— User —
[MBR] 5985724ba892a5726b4ce24e2f48fbe8
[BSP] eb11fb66582f439466a24426dcc02753 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 76217 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 156299264 | Size: 400620 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[0]_S_10072013_084622.txt >>

Does that seem weird? as its hooked to explorer.exe , never seen that before

2

It could be one of any number of programmes, are you experiencing any problems ?

3

Nothing now except high cpu usage from googleupdate.exe but thats gone ( i guess its related to google chrome)
a query though

http://i.imgur.com/fCOWXEx.png?1

does anything look suspicious?

Also Got 2 more hooks while windows update was running
RogueKiller V8.7.1 [Oct 3 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : PatricK [Admin rights]
Mode : Scan – Date : 10/08/2013 12:39:05
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[HJ POL][PUM] HKCU[…]\System : DisableRegistryTools (0) → FOUND
[HJ POL][PUM] HKLM[…]\System : DisableRegistryTools (0) → FOUND
[HJ DESK][PUM] HKCU[…]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) → FOUND
[HJ DESK][PUM] HKCU[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) → FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤
[Inline] EAT @explorer.exe (?s_pClassInfo@CCRadioButton@DirectUI@@0PAUIClassInfo@2@A) : DUI70.dll → HOOKED (Unknown @ 0x7BA8A724)
[Inline] EAT @explorer.exe (?s_pClassInfo@Edit@DirectUI@@0PAUIClassInfo@2@A) : DUI70.dll → HOOKED (Unknown @ 0x4BA8A144)
[Inline] EAT @explorer.exe (?s_pClassInfo@Macro@DirectUI@@0PAUIClassInfo@2@A) : DUI70.dll → HOOKED (Unknown @ 0x6BA8A703)

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
→ %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\.\PHYSICALDRIVE0 @ IDE) (Standard disk drives) - WDC WD5000AADS-67S9B1 ATA Device +++++
— User —
[MBR] 5985724ba892a5726b4ce24e2f48fbe8
[BSP] eb11fb66582f439466a24426dcc02753 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 76217 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 156299264 | Size: 400620 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[0]_S_10082013_123905.txt >>

4

As you are using Comodo that will hook explorer

5

ok, so nothing weird there,
thanks for your help