What are these... ?

Discussion in 'other software & services' started by SG1, Jul 13, 2006.

Thread Status:
Not open for further replies.
  1. SG1

    SG1 Registered Member

    Joined:
    Jan 16, 2003
    Posts:
    432
    Will post two screencaps, re oddball entries: happened to use msconfig dialog box the other night, and saw these listings. No idea what they are, how long they've been there, but it seems a bit unsettling.

    Thanks, for any ideas on this, SG1 (Pat)
     

    Attached Files:

  2. SG1

    SG1 Registered Member

    Joined:
    Jan 16, 2003
    Posts:
    432
    And, here's second entry.

    SG1 (Pat)
     

    Attached Files:

  3. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    The Windows service entry strikes me as a randomly named file used by RootkitRevealer :doubt: That randomly named service is created by RootkitRevealer.exe in %temp% but when the service exits it should be deleted. If you search the hard drive do you find that possible .exe file in a temp folder and have you recently used Sysinternals RootkitRevealer ?

    Bubba
     
  4. SG1

    SG1 Registered Member

    Joined:
    Jan 16, 2003
    Posts:
    432
    Bubba;

    Used SI's RKR a while back; seemed to have trouble running it re other security apps allowing it (as RKR now creates random file name/s, as method to fool possible black hats on one's PC as I understand it).

    Did search for the "U... whatever" listing, and found nothing.

    Thanks, SG1 (Pat)
     
  5. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Was that "U... whatever" search in regards to the registry also ?

    Since it's shown as a service I'd be sure I took care and made sure I was looking for this whatever file.
     
  6. SG1

    SG1 Registered Member

    Joined:
    Jan 16, 2003
    Posts:
    432
    Bubba;

    Pardon me, I stand corrected. I did search of C: drive, not the reg., and you are right of course about looking in the reg. I'll do that.

    Thanks, SG1 (Pat)
     
  7. SG1

    SG1 Registered Member

    Joined:
    Jan 16, 2003
    Posts:
    432
    Bubba;

    Re my mystery "U... whatever" file (so-called as I didn't have name proper in front of me at the time, but I'm not blaze about unknowns of any type on our PC).

    Here is reg. report about said file, and I still have no idea what this pertains to - any ideas?

    Thanks, SG1 (Pat)

    ==================================
    REGEDIT4

    ; Registry Search 2.0 by Bobbi Flekman © 2005
    ; Version: 2.0.1.0

    ; Results at 7/13/2006 4:18:27 PM for strings:
    ; 'uvztldxk'
    ; Strings excluded from search:
    ; (None)
    ; Search in:
    ; Registry Keys Registry Values Registry Data
    ; HKEY_LOCAL_MACHINE HKEY_USERS


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services]
    "UVZTLDXK"=dword:00000003

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_UVZTLDXK]

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_UVZTLDXK\0000]

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_UVZTLDXK\0000]
    "Service"="UVZTLDXK"
    "DeviceDesc"="UVZTLDXK"

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\UVZTLDXK]

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\UVZTLDXK]
    "DisplayName"="UVZTLDXK"

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\UVZTLDXK\Security]

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\UVZTLDXK\Enum]

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\UVZTLDXK\Enum]
    "0"="Root\\LEGACY_UVZTLDXK\\0000"

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_UVZTLDXK]

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_UVZTLDXK\0000]

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_UVZTLDXK\0000]
    "Service"="UVZTLDXK"
    "DeviceDesc"="UVZTLDXK"

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\UVZTLDXK]

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\UVZTLDXK]
    "DisplayName"="UVZTLDXK"

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\UVZTLDXK\Security]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_UVZTLDXK]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_UVZTLDXK\0000]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_UVZTLDXK\0000]
    "Service"="UVZTLDXK"
    "DeviceDesc"="UVZTLDXK"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UVZTLDXK]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UVZTLDXK]
    "DisplayName"="UVZTLDXK"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UVZTLDXK\Security]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UVZTLDXK\Enum]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UVZTLDXK\Enum]
    "0"="Root\\LEGACY_UVZTLDXK\\0000"

    [HKEY_USERS\S-1-5-21-796845957-1960408961-725345543-1003\Software\Novatix\ExplorerPlus\CurrentVersion\NxFind\FileNames]
    "1"="UVZTLDXK "

    ; End Of The Log...
     
Loading...
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.