Win32/Sorin.A Worm

Discussion in 'NOD32 version 2 Forum' started by LuSiD, Jul 25, 2003.

Thread Status:
Not open for further replies.
  1. LuSiD

    LuSiD Registered Member

    Joined:
    Jul 25, 2003
    Posts:
    25
    Location:
    Vegemite Central
    Nod keeps detecting this worm in the wild, however when I do a system scan it detects nothing. I have been having small probs with my sys for a week or so which indicates something is there......
    I can find no reference to this worm on any official Nod sites....does anyone know anything about this little bugger...am I going to have to reformat and start again to get rid of it...........

    Any help appreciated muchly...
     
  2. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Simple answer is no, I would slave your drive off a clean protected system and have it scan your infected drive, to see if anything is there, I'd also run it through a second virus program using the same method just to be sure...

    Nod has been detecting it since v.1.454 (20030707) see http://www.nod32.com/support/info.htm

    Hope this helps.

    Cheers :D
     
  3. martindijk

    martindijk Registered Member

    Joined:
    Jun 13, 2003
    Posts:
    537
    Location:
    Gorredijk - the Netherlands
    Hi Lusid,

    Can you tell me some more about this, what kind of probs.

    How can you be sure you have that particular worm on your system.

    What are the symtons??

    rgds,
    Martin
     
  4. LuSiD

    LuSiD Registered Member

    Joined:
    Jul 25, 2003
    Posts:
    25
    Location:
    Vegemite Central
    Small probs is a bit vague I know..........it's just that there is nothing going wrong persay..........it's more like my system is very 'sticky'.

    I don't have the fastest of systems anyway, but I really notice when things slow down.

    Let me explain. Probs seemed to start after a LAN night. All persons present were using Norton 2003 at the time, after that night a few guys started having probs with system lockups etc...assuming it was Norton (as it is huge, and very invasive) a few of us ditched Norton in favour of Nod or Vet.

    With my system, it started detecting the Sorin.A worm, here and there, usually it could clean or delet no probs, then all of a sudden a few popped up that could not be deleted or renamed or anything.

    I wasn't too worried as I understand that if it's detected it hasn't made it into my system, I was told the antivirus 'locks' the file so it can't go anywhere.

    The only specific prob I've had that I can pinpoint is quite often I leave my PC running overnight to download large files (only 56k dial up) when I get up to check it in the morning the Virus detected screen is up telling me that it detected Sorin.A.

    It appears that my internet connection whilst still showing as active, is locked out as my download manager is no longer able to find the files and any attempt to browse is met with domain errors..

    Also, the indications are that the file is being 'restored' by my system, thus I have disabled the restore function temporarily to see if that may fix the prob.

    Meanwhile I have got another AV program and will try the other suggestion above...

    Hope this makes sense, if not try MSN or email me
    zooology2003@yahoo.com

    LuSiD
     
  5. martindijk

    martindijk Registered Member

    Joined:
    Jun 13, 2003
    Posts:
    537
    Location:
    Gorredijk - the Netherlands
  6. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Are you using a firewall?
     
  7. LuSiD

    LuSiD Registered Member

    Joined:
    Jul 25, 2003
    Posts:
    25
    Location:
    Vegemite Central
    Martin - I'll download that stuff and then post the results...... :-*

    Blackspear - yes, I have ZoneAlarm Pro, I don't think that's causing any dramas though because I have had that for ages and probs are only very recent......

    disabling the restore functions may have done the trick, left it on all last night without any virus detections or interruptions to downloading....fingers crossed ;)

    Guys, thanks heaps for your help so far, will post again tomorrow...
     
  8. LuSiD

    LuSiD Registered Member

    Joined:
    Jul 25, 2003
    Posts:
    25
    Location:
    Vegemite Central
    Maritn, downloaded those appz, spybot is a nice littel gem, it found 13 nasties lurking on my system, they are now dead!!! :D

    Now you wanted me to post the stuff from hijackthis, two lists compiled and here they are....................
    bloody long lists they are :doubt:
    Logfile of HijackThis v1.95.1
    Scan saved at 11:28:43 PM, on 26/07/2003
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Eset\nod32krn.exe
    C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\System32\taskswitch.exe
    C:\WINDOWS\System32\fast.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
    C:\WINDOWS\System32\ZoneLabs\vsmon.exe
    C:\Progra~1\Fellowes\WEBPRO~1\wh_exec.exe
    C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
    C:\WINDOWS\System32\Fast.exe
    C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
    C:\Program Files\Eset\nod32kui.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Tweak-XP\blads.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
    C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
    D:\Sys Utilities\HijackThis Quick Start_files\HijackThis.exe
    C:\Program Files\Internet Explorer\iexplore.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System32\blank.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://home.whazit.com
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_4_0.dll
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\Program Files\FlashGet\jccatch.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_4_0.dll
    O3 - Toolbar: Search - {A58686ED-FC46-44C3-95C6-4A812AB776F1} - C:\Program Files\FerretSoft\WebFerret\FerretBand.dll
    O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
    O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\System32\taskswitch.exe
    O4 - HKLM\..\Run: [FastUser] C:\WINDOWS\System32\fast.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [WheelMouse] C:\Progra~1\Fellowes\WEBPRO~1\wh_exec.exe
    O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
    O4 - HKLM\..\Run: [Ad-watch] C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
    O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [BlockAds] C:\Program Files\Tweak-XP\blads.exe
    O4 - Startup: Norton System Doctor.LNK = C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
    O4 - Startup: PowerReg Scheduler V3.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
    O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm
    O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O9 - Extra button: FlashGet (HKLM)
    O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
    O9 - Extra button: Yahoo! Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O9 - Extra button: NeoTrace It! (HKCU)
    O10 - Broken Internet access because of LSP provider 'imon.dll' missing
    O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: ConferenceRoom Java Client - http://chat.privatefeeds.com:8000/java/cr.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/10fe318e1dd50d841905/netzip/RdxIE601.cab
    O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptemplates/ActiveSecurity.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37747.0009143519
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/ym/yiebio5_1_4_0.cab


    And startup list

    StartupList report, 26/07/2003, 11:29:58 PM
    StartupList version: 1.52
    Started from : D:\Sys Utilities\HijackThis Quick Start_files\HijackThis.EXE
    Detected: Windows XP SP1 (WinNT 5.01.2600)
    Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    * Using default options
    ==================================================

    Running processes:

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Eset\nod32krn.exe
    C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\System32\taskswitch.exe
    C:\WINDOWS\System32\fast.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
    C:\WINDOWS\System32\ZoneLabs\vsmon.exe
    C:\Progra~1\Fellowes\WEBPRO~1\wh_exec.exe
    C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
    C:\WINDOWS\System32\Fast.exe
    C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
    C:\Program Files\Eset\nod32kui.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Tweak-XP\blads.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
    C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
    D:\Sys Utilities\HijackThis Quick Start_files\HijackThis.exe
    C:\Program Files\Internet Explorer\iexplore.exe

    --------------------------------------------------

    Listing of startup folders:

    Shell folders Startup:
    [C:\Documents and Settings\Adam\Start Menu\Programs\Startup]
    Norton System Doctor.LNK = C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
    PowerReg Scheduler V3.exe

    Shell folders Common Startup:
    [C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
    InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe

    --------------------------------------------------

    Checking Windows NT UserInit:

    [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    UserInit = C:\WINDOWS\system32\userinit.exe,

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run

    CoolSwitch = C:\WINDOWS\System32\taskswitch.exe
    FastUser = C:\WINDOWS\System32\fast.exe
    NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    nwiz = nwiz.exe /install
    WheelMouse = C:\Progra~1\Fellowes\WEBPRO~1\wh_exec.exe
    CloneCDElbyCDFL = "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
    QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
    IntelliType = "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
    Ad-watch = C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
    nod32kui = C:\Program Files\Eset\nod32kui.exe /WAITSERVICE
    NeroCheck = C:\WINDOWS\system32\NeroCheck.exe

    --------------------------------------------------

    Autorun entries from Registry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run

    NVIEW = rundll32.exe nview.dll,nViewLoadHook
    MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
    BlockAds = C:\Program Files\Tweak-XP\blads.exe
    TransparentIcons =
    Tweak-XP =

    --------------------------------------------------

    Load/Run keys from C:\WINDOWS\WIN.INI:

    load=*INI section not found*
    run=*INI section not found*

    Load/Run keys from Registry:

    HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
    HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
    HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
    HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
    HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
    HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
    HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
    HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
    HKCU\..\Windows NT\CurrentVersion\Windows: load=
    HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
    HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
    HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
    HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=apitrap.dll

    --------------------------------------------------

    Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

    Shell=*INI section not found*
    SCRNSAVE.EXE=*INI section not found*
    drivers=*INI section not found*

    Shell & screensaver key from Registry:

    Shell=Explorer.exe
    SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
    drivers=*Registry value not found*

    Policies Shell key:

    HKCU\..\Policies: Shell=*Registry key not found*
    HKLM\..\Policies: Shell=*Registry value not found*

    --------------------------------------------------


    Enumerating Browser Helper Objects:

    (no name) - C:\WINDOWS\Downloaded Program Files\ycomp5_1_4_0.dll - {02478D38-C3F9-4efb-9B51-7695ECA05670}
    (no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
    (no name) - C:\Program Files\FlashGet\jccatch.dll - {A5366673-E8CA-11D3-9CD9-0090271D075B}

    --------------------------------------------------

    Enumerating Task Scheduler jobs:

    Norton SystemWorks One Button Checkup.job
    Symantec NetDetect.job

    --------------------------------------------------

    Enumerating Download Program Files:

    [Shockwave ActiveX Control]
    InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
    CODEBASE = http://active.macromedia.com/director/cabs/sw.cab

    [RdxIE Class]
    InProcServer32 = C:\WINDOWS\Downloaded Program Files\RdxIE.dll
    CODEBASE = http://207.188.7.150/10fe318e1dd50d841905/netzip/RdxIE601.cab

    [SecureLogin.SecureControl]
    InProcServer32 = C:\WINDOWS\Downloaded Program Files\ActiveSecurity.ocx
    CODEBASE = http://secure2.comned.com/signuptemplates/ActiveSecurity.cab

    [Update Class]
    InProcServer32 = C:\WINDOWS\System32\iuctl.dll
    CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37747.0009143519

    [Symantec RuFSI Registry Information Class]
    InProcServer32 = C:\WINDOWS\Downloaded Program Files\rufsi.dll
    CODEBASE = http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab

    [Shockwave Flash Object]
    InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
    CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    [Yahoo! Companion]
    InProcServer32 = C:\WINDOWS\Downloaded Program Files\ycomp5_1_4_0.dll
    CODEBASE = http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/ym/yiebio5_1_4_0.cab

    --------------------------------------------------

    Enumerating ShellServiceObjectDelayLoad items:

    PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
    CDBurn: C:\WINDOWS\system32\SHELL32.dll
    WebCheck: C:\WINDOWS\System32\webcheck.dll
    SysTray: C:\WINDOWS\System32\stobject.dll

    --------------------------------------------------
    End of report, 7,882 bytes
    Report generated in 0.110 seconds

    Command line options:
    /verbose - to add additional info on each section
    /complete - to include empty sections and unsuspicious data
    /full - to include several rarely-important sections
    /force9x - to include Win9x-only startups even if running on WinNT
    /forcent - to include WinNT-only startups even if running on Win9x
    /forceall - to include all Win9x and WinNT startups, regardless of platform
    /history - to list version history only

    Hope this makes sense to you because I'm a little confused by it all....after 5 years trying to keep up I thought I was finally learning something............and I have, I now know enough to know what I don't know..... :D

    I will be offline for the next few days, taking a trip up to the big smoke so wifey can go to hospital for a minor op, will check back in a couple of days....Thanks............LuSiD
     
  9. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,332
    Location:
    Netherlands
    Hi LuSiD,

    Check the following items in HijackThis.
    Close all windows except HijackThis and click Fix checked:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://home.whazit.com
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/10fe318e1dd50d841905/netzip/RdxIE601.cab
    O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptemplates/ActiveSecurity.cab

    Reboot after doing so.

    Regards,

    Pieter
     
  10. LuSiD

    LuSiD Registered Member

    Joined:
    Jul 25, 2003
    Posts:
    25
    Location:
    Vegemite Central
    Thanks for that.........only what are they?
    And I assume that once they are fixed they will not return?

    LuSiD
     
  11. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,332
    Location:
    Netherlands
    Explanation:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    Orphaned link in your registry
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://home.whazit.com
    Remainder of the hijack to whazit
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/10fe318e1dd50d841905/netzip/RdxIE601.cab
    Minor security risk
    O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptemplates/ActiveSecurity.cab
    New (dutch) porn dialer

    They should stay away, but it can't hurt to check afterwards.

    Regards,

    Pieter
     
  12. LuSiD

    LuSiD Registered Member

    Joined:
    Jul 25, 2003
    Posts:
    25
    Location:
    Vegemite Central
    Thanks for the help..........

    also to Martin and Blackspear............

    btw, I like your signiature pieter, very true... :)
     
Thread Status:
Not open for further replies.