View Single Post
Old 08-18-2005, 06:28 PM   #4 (permalink)
MicroBell
Manager Emeritus - Security Center, Expert Analyst, Moderator - Security Team; Rangemaster, TSF Academy & Supporter
 
MicroBell's Avatar
 
Join Date: Sep 2004
Location: Carmichaels, PA-USA
Posts: 6,963
OS: Windows 7


Send a message via ICQ to MicroBell Send a message via MSN to MicroBell
Question....

Are these part of your ISP and/or company network??

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://209.239.242.217/
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = deltamicrowave.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = deltamicrowave.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = deltamicrowave.com


Those 4 entrys are tied together pointing to that site and it's IP

O17 - HKLM\System\CCS\Services\Tcpip\..\{3143A686-7C06-4E13-9C0E-4C877CEDF40E}: NameServer = 207.178.128.20,207.178.128.21
O17 - HKLM\System\CCS\Services\Tcpip\..\{668CBD1E-5F8D-416C-87EE-4CE26954F542}: NameServer = 207.178.128.20,207.178.128.21


These IP's come back as Internet Specialties West, Inc.
__________________
We Are The BORG Spyware KILLER and Adware Destroyer!





Spyware/Adware Removal Tools
Hijackthis
Ad-aware SE
Spybot Search&Destroy
SpywareBlaster
CWShredder
MicroBell is offline