Mike
Wed Dec 17 17:11:04 CST 2003
ja,
The cause is unknown ..... just have HijackThis "fix" that one entry.
[more info]
http://www.google.com/search?num=20&hl=en&lr=&ie=UTF-8&oe=UTF-8&safe=off&sa=G&q=%22dcsresearch.%2Bcom%22
____________________________________________________________
Mike Burgess [MVP Windows Shell\User]
http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-15-03]
Please post replies to this Newsgroup, email address is invalid
--
"ja" <nobody@nobody.com> wrote in message
news:unly3pOxDHA.2448@TK2MSFTNGP12.phx.gbl...
> Term Server & VNC is supposed to run on he box and is protected by
firewall.
> Only specific IPs are allowed to connect. The only thing I find puzzling
is:
> Hosts: 203.161.127.141 www.dcsresearch.com
> What would make an entry like that in the box' host file?
>
> Logfile of HijackThis v1.97.7
> Scan saved at 3:17:06 PM, on 12/17/2003
> Platform: Windows 2000 SP4 (WinNT 5.00.2195)
> MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
>
> Running processes:
> C:\WINNT\System32\smss.exe
> C:\WINNT\system32\winlogon.exe
> C:\WINNT\system32\services.exe
> C:\WINNT\system32\lsass.exe
> C:\WINNT\System32\termsrv.exe
> C:\WINNT\system32\svchost.exe
> C:\WINNT\System32\msdtc.exe
> C:\Program Files\Dell\OpenManage\OMSA\bin\dcevt32.exe
> C:\Program Files\Dell\OpenManage\OMSA\bin\dcstor32.exe
> C:\Program Files\NavNT\defwatch.exe
> C:\WINNT\System32\svchost.exe
> C:\WINNT\System32\llssrv.exe
> C:\Program Files\Dell\OpenManage\Array Manager\mr2kserv.exe
> C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlservr.exe
> C:\Program Files\NavNT\rtvscan.exe
> C:\Program Files\Dell\OpenManage\RAC\MN\racsrvc.exe
> C:\Program Files\Dell\OpenManage\RAC\VNC\RACWinVNC.exe
> C:\WINNT\system32\MSTask.exe
> C:\Program Files\Dell\OpenManage\iws\bin\win32\omaws32.exe
> C:\WINNT\System32\tcpsvcs.exe
> C:\Program Files\Dell\OpenManage\Array Manager\VxSvc.exe
> C:\WINNT\System32\WBEM\WinMgmt.exe
> C:\WINNT\system32\svchost.exe
> C:\Program Files\True North Software\IA eMailServer\MailServer.exe
> C:\WINNT\System32\dns.exe
> C:\WINNT\System32\inetsrv\inetinfo.exe
> C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
> \?\C:\IISDebugTools\_IISCHAgent.exe
> C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlagent.exe
> C:\WINNT\System32\svchost.exe
> C:\WINNT\system32\MsgSys.EXE
> C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
> C:\PROGRA~1\Dell\OPENMA~1\oldiags\vendor\pcdoctor\bin\diagorb.exe
> C:\WINNT\system32\logon.scr
> C:\WINNT\system32\winlogon.exe
> C:\WINNT\system32\rdpclip.exe
> C:\WINNT\Explorer.EXE
> C:\WINNT\system32\BacsTray.exe
> C:\Program Files\NavNT\vptray.exe
> C:\WINNT\system32\internat.exe
> C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
> C:\Program Files\Internet Explorer\IEXPLORE.EXE
> C:\Program Files\WinZip\WZQKPICK.EXE
> C:\WINNT\system32\wuauclt.exe
> C:\PROGRA~1\WINZIP\winzip32.exe
> I:\hijackthis\HijackThis.exe
>
> R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext =
> https://127.0.0.1:1311/
> O1 - Hosts: 203.161.127.141 www.dcsresearch.com
> O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
> C:\WINNT\System32\msdxm.ocx
> O4 - HKLM\..\Run: [bacstray] BacsTray.exe
> O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
> O4 - HKCU\..\Run: [internat.exe] internat.exe
> O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL
> Server\80\Tools\Binn\sqlmangr.exe
> O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program
> Files\WinZip\WZQKPICK.EXE
> O9 - Extra button: Related (HKLM)
> O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
> O16 - DPF: ITA644 - file://C:\Program Files\Dell\OpenManage\IT
> Assistant\UserInterfaceComponents\ITA644.CAB
> O16 - DPF: {9F1C11AA-197B-4942-u6gf-47jhg89BB47F} (Update Class) -
>
http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37869.1038194444
> O16 - DPF: {C2FCEF52-ACE9-11D3-Bjhf-001jhgA9B6AE} (Symantec RuFSI Registry
> Information Class) -
>
http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
> O16 - DPF: {ED990224-80E6-11D3-9780-00105ytg47BB} (RACView Control) -
> file://C:\Program Files\Dell\OpenManage\Drac\client\Web\WebRacView.cab
>
> "Dirk" <dirk@nomail.no> skrev i en meddelelse
> news:SnXDb.3603$7U1.29625@amstwist00...
> >
> > "ja" <nobody@nobody.com> schreef in bericht
> > news:uzdIbHGxDHA.2396@TK2MSFTNGP09.phx.gbl...
> > > Hi Dirk
> > >
> > > I never install anything on my boxes unless I know what it is, so
> > Hijackthis
> > > will not be installed.
> > > Show me a CNET review of your software and maybe I will feel more
> > > confortable.
> >
> >
http://download.com.com/3000-2144-10227352.html
> >
> >
>
>