Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Suspicious rkill behaviour after cloning drive

  • Please log in to reply
4 replies to this topic

#1 MMoskowitz9


  • Members
  • 5 posts
  • Local time:06:12 PM

Posted 29 July 2016 - 08:33 PM



I just cloned my hard drive and booted off the new one for the first time (I had to disable windows 10 uefi secure boot for one boot-up to do the clone). Upon running my computer off the new drive, I ran an old version of rkill that had been sitting in downloads since February and got the following message, which I hadn't seen before.



 * ALERT: ZEROACCESS Reparse Point/Junction found!

     * C:\Program Files\Windows Defender\MpTpmAtt.dll => <Unknown Target> [File]
     * C:\Program Files\Windows Defender\MsMpRes.dll => <Unknown Target> [File]
     * C:\Program Files (x86)\Windows Defender\MpAsDesc.dll => <Unknown Target> [File]
     * C:\Program Files (x86)\Windows Defender\MpClient.dll => <Unknown Target> [File]
     * C:\Program Files (x86)\Windows Defender\MsMpLics.dll => <Unknown Target> [File]



There are also many many many under this one


* Reparse Point/Junctions Found (These may be legitimate)!

     * C:\WINDOWS\AppPatch\AcGenral.dll => <Unknown Target> [File]
     * C:\WINDOWS\AppPatch\AcSpecfc.dll => <Unknown Target> [File]
     * C:\WINDOWS\AppPatch\AcWinRT.dll => <Unknown Target> [File]
     * C:\WINDOWS\AppPatch\AcXtrnal.dll => <Unknown Target> [File]
     * C:\WINDOWS\AppPatch\apppatch64\AcWinRT.dll => <Unknown Target> [File]
     * C:\WINDOWS\assembly\GAC_32\Microsoft.Ink\\Microsoft.Ink.dll => <Unknown Target> [File] .... goes on and on.



When I downloaded rkill from rkill.com and ran it however, it ran completely clean.


Should I be concerned, or is this just a side effect my cloning my drive/old rkill?





BC AdBot (Login to Remove)


#2 MMoskowitz9

  • Topic Starter

  • Members
  • 5 posts
  • Local time:06:12 PM

Posted 29 July 2016 - 11:31 PM

Just updating, Malwarebytes Anti-Malware ran clean. Still would appreciate the input of an expert though.

#3 MMoskowitz9

  • Topic Starter

  • Members
  • 5 posts
  • Local time:06:12 PM

Posted 29 July 2016 - 11:37 PM

I moved this over to 'Virus, Trojan, Spyware, and Malware Removal Logs' as it conains rkill output. If this is the best place to have this just let me know though and I'll kill the other thread.

Edited by MMoskowitz9, 29 July 2016 - 11:45 PM.

#4 Queen-Evie


    Official Bleepin' G.R.I.T.S. (and proud of it)

  • Members
  • 16,485 posts
  • Gender:Female
  • Location:My own little corner of the universe (somewhere in Alabama). It's OK, they know me here
  • Local time:07:12 PM

Posted 30 July 2016 - 10:25 AM

MMoskowitz9,  RKill is allowed in Am I Infected.


Because it can be used in AII, I deleted your post in Malware Removal Logs.


If an AII malware removal helper feels you should post in MRL, you will be directed to the Prep Guide for that forum.

#5 boopme


    To Insanity and Beyond

  • Global Moderator
  • 73,492 posts
  • Gender:Male
  • Location:NJ USA
  • Local time:08:12 PM

Posted 02 August 2016 - 09:32 AM

Hello, with ZeroAcces infection you will need to post in that forum, but you need to include a FRST log.. Start at step 6.

Please follow this Preparation Guide and post in a new topic.
Let me know if all went well.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users