Weird autostart-programs ?

[hackerman1]

Hi !

A few days ago i noticed some mysterious autostart-programs in Winpatrol:

---

MSKSSRV RunDLL32.exe streamd,StreamingDeviceSetup {96E080C7-143C-1 1Ð 1-840F-00A0C9223 196},{3C0D50 IA-1408-11D 1-840F-00A0C9223 196},{3C0D50 IA-140B-1 1D 1-840F-00A0C9223196}

MSPCLOCK RunDLL32.exe streamd,StreamingDeviceSetup {97ebaacc-95bd-1 ldO-a3ea-00a0c9223 196},{53 172480-479 1-11DO-A506-28D504C 10000},{53172480-479 1-1 1DO-A5D6-280804C 10000>

MSPQM RunDLL32.exe sfreamd,SfreamingDeviceSetup {bDF4358E-882C- 1 1D0-A42F-00A0C9223
196},{97EBAACB-958D-1 1DO-A3EA-00A0C9223196},{97EBAACB-958D-1 1DO-A3EA-00A0C9223 196}

MSTEE.CxTransform RunDLL32.exe ksfilter.inf,MSTEE.Interface.Install

MSTEE, Splitter RunDLL32.exe ksfilter.inf,MSTEE, Iriterface.Install

---

They are all listed as “Run Once”, but they remain even after several reboots.

In the “Company column” it says “File not found” ???

Some searching found a few webbsites talking about malware, which made me wonder what had happened.
So i restored my fresh system-backup, created just a few days ago before i installed the October-updates.
I then installed one update at a time until i saw those autostart-programs again in Winpatrol.

After investigation i have found the cause: a Microsoft security update from October: KB2868038 !
Some USB-drivers for audio & video….

And uninstalling the update doesn´t help, those programs are still listed ???

MS13-081: Description of the security update for USB drivers: October 8, 2013: http://support.microsoft.com/kb/2868038

Microsoft Security Bulletin MS13-081 – Critical, KB2868038: http://technet.microsoft.com/en-us/security/bulletin/ms13-081

So if you have WinPatrol or some other program that shows autostart-programs, then now you know the cause of this.

I´m going to report this to Microsoft, if i can find out how…
I need an email-address…

[Author]

Posts