0

So, for some context, I'm a little paranoid because a few days ago, I let a friend put together her PowerPoint presentation on my Windows 8.1 Pro N laptop, and when I had looked away for a moment, she had inserted a thumbdrive to save her work on. As a rule, I don't allow mysterious thumbdrives in my computers. Especially not from the less technologically literate. :)

I haven't noticed anything unusual until today. I do occasionally see high CPU usage from various background processes, particularly the ones associated with Windows Update. It usually goes on for a little while and then stops. But today, I've seen something I've never seen before: MsMpEng.exe/Windows Defender has been using 100% of a CPU for over five hours. It did update today: once when I booted up, and just now, when I manually updated (and saw no change.)

I let alone it alone for a while in case it was actually doing something I cared about. But it didn't stop, so I decided to open up Resource Monitor to see what it was doing. MsMpEng.exe is reading a bunch of files in C:\Windows\System32\catroot, which I assume is part of a scheduled scan, although I can't find any other indication a scan is in progress. But what really concerned me is this: the most written to file (by System) is a Microsoft Windows Code Integrity event log file.

So I popped open Event Viewer, and discovered that, almost continuously, 1700 warning events (the exact number is sometimes lower, sometimes higher) that look like this:

Code Integrity was unable to load the Microsoft-Windows-WMPNetworkSharingService-Package~31bf3856ad364e35~amd64~~6.3.9600.16384.cat catalog because the signing certificate for this catalog has been revoked. This can result in images failing to load because a valid signature cannot be found. Check with the publisher to see if a new signed version of the catalog and images are available.

are being created (with the particular .cat varying) and then deleted.

What's going on? I can't find any relevant results on Google for this particular event, and I can imagine that it's the result of some kind of malware. If the certificate is revoked, wouldn't the catalog be replaced via Windows Update? Will Windows Defender ever finish running while this event is being triggered? It looks like when I refresh, the same catalogs are showing up with new events.

Update:

I've also run sfc /scannow, which detected a corrupted (printer) driver that I repaired with dism. After a reboot, I'm not seeing the 100% CPU usage from Windows Defender, but it looks like it did run this morning and logged the same ~1700 certificate warnings. Additionally, I noticed some error logs were included this time - not sure if they always were, there's much less of them. They look like this:

Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Still totally baffled as to what is going on. For what it's worth, it does appear that all the warnings are about different Windows Media Player catalogs, while all the errors are about the same Silverlight DLL.

Update 2: I've also looked directly at the certificates (navigate to C:\Windows\System32\catroot, right click on the catalog in question, digital signatures tab), and Windows Explorer reports that the certificates are "OK" and doesn't list any revocation status. They are, however, expired...

6
  • Windows Defender is not the best tool for finding malware. I suggest you run Malwarebytes. ==> malwarebytes.org/2
    – whs
    Apr 27, 2015 at 17:27
  • run DISM to detect and fix corrupted files: blogs.technet.com/b/joscon/archive/2012/09/26/… Apr 27, 2015 at 17:43
  • @whs: MalwareBytes did not detect anything. SFC did discover some corrupted files and was unable to fix them; I run it pretty regularly so that's a new issue that I suspect is related.
    – Shamshiel
    Apr 27, 2015 at 18:22
  • See whether startup/repair can fix the corrupted files. ==> sevenforums.com/tutorials/681-startup-repair.html
    – whs
    Apr 27, 2015 at 18:26
  • whs and @magicandre1981: I ran dism and it repaired the corrupted files detected by sfc /scannow, but as of this morning (and after a reboot), the event log still contains new warnings of the same kind. Additionally, I'm now seeing some straight-up errors.
    – Shamshiel
    Apr 28, 2015 at 13:21

0

You must log in to answer this question.

Browse other questions tagged .