A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #20426  by Thanat0S
 Thu Aug 08, 2013 9:53 pm
Hello there I created this thread becuase I have 2 q
Im suspecting that Im infected, my scenery:

~ hello world in VS2012
~ I start debugging mode
~ I stop it
~ I change the src then F7 (rebuild solution) and I get this:
Code: Select all
1>LINK : fatal error LNK1168: cannot open C:\Users\Admin\Desktop\Hellow\Debug\Hellow.exe for writing
========== Build: 0 succeeded, 1 failed, 0 up-to-date, 0 skipped ==========
check file with Lockhunter I got this:
Image
Handle from system thread (!)
I guess that manipulating processes form km :P

I scanned with roguekiller,pchunter,gmer , etc and any didnt found anything.
My system is Win7 x64 , no any antivirus on my system, onyl sandboxie.
I would like know some advice from you guys , thanks!
 #20428  by EP_X0FF
 Fri Aug 09, 2013 2:26 am
No you are not infected. This is known "feature" of Application Experience service. Turn it off as all of unnecessary Windows services. The reason is because Application Experience service is used to process application compatibility cache requests for applications as they are launched.

Image