Win 7 SP1 - Mysterious services update?

Hi all On checking windows services after the sp1 update I noticed these two new items in the listing.

RHKH & GQRFNVTJO

Does anyone have a clue as to what these "services" actually do or are they just markers?

Ich

Let's see what they are.

Download DDS from one of these links:
Mirror 1 Mirror 2 Mirror 3

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt < this will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next reply.

On first check with win services they were set to auto, then I set them to manual in case they were system critical. Here is a split from the dds. listing & both point to temp folders.


S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888] S3 GQRFNVTJO;GQRFNVTJO;c:\users\admini~1\appdata\local\temp\gqrfnvtjo.exe --> c:\users\admini~1\appdata\local\temp\GQRFNVTJO.exe [?] S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2009-9-7 7168] S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544] S3 RHKH;RHKH;c:\users\admini~1\appdata\local\temp\rhkh.exe --> c:\users\admini~1\appdata\local\temp\RHKH.exe [?] S3 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2011-1-10 993848] S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-2-23 52224] S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-11-6 1343400] .

Okay, they're in appdata\local\temp

Please download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

Jacee No longer any sign of these mysterious items. May I thank you for your knowledgeable guidance. Ich...

You're welcome

Looks it is something to do with Remote FX & Microsoft VM (virtual Machine) combined (but this case here, is a badly installed drivers).

I have all those files in C:\Windows\System32 (1st screenshot) & C:\Windows System32\Drivers (2nd screenshot)

https://blogs.msdn.com/b/rds/archive...on-part-3.aspx