HijackThis question 1

[tahoe2]

Hello.

Last time I ran HijackThis, I got the following line in the log, Can anyone tell me what it means?

016-DPF: {1FB464C8-09BB-4017 A2F5 EB742F04392F} (MICROSOFT TERMINAL SERVICES CONTROL (REDIST))

http://tsweb.pcsnapa.com/mstscax.cab

I am of the opinion it is a doorway where other folks (namely, those folks at PCS Napa) can get into the system.
Am I correct, or is it something else?

BTW, I deleted the line. Those folks are no longer affiliated with this company.

Thanks!

Corie

 

[DavidDCSA]

I think you will find your answer at:

http://www.securiteam.com/windowsntfocus/5MP0L1F80A.html

 

[carrr]

Or here:

http://support.microsoft.com/servicedesks/webcasts/wc011201/WC011201.ppt

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[tahoe2]

Thanks for both those links!
If I understand this correctly, when PCS worked on the system sometime in the past, they accessed a website that downloaded these controls onto my servers. If that is the case, and I have closed the access port in question, then I don't need to worry, correct?

Thanks,
Corie

 

[carrr]

You can blow 016 entries away at will. IF they are needed down the road, you'll be prompted for a new download. Plain and simple.

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[tahoe2]

excellent! i love plain and simple.

thanks,
Corie