Welcome Guest ( Log In | Click here to Register a free account now! )
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.| Important Announcement: In recognition of reaching a milestone of 1,000,000 posts on the site, we are hosting the BC 1 Million Post contest. More information about this contest can be found at the following link: Bleeping Computer 1,000,000 Post Contest - BleepingComputer Management |
![]() ![]() |
Jan 11 2006, 09:11 PM
Post
#1
|
|
|
New Member ![]() Group: Members Posts: 4 Joined: 11-January 06 Member No.: 50,240 |
Registry value name: nosign Command line: c:\WINDOWS\\nosign.exe /STARTUP location: C:\WINDOWS\nosign Description: No version, nothing descriptive from Autoruns or HT, nothing on Google (except several hits on this as an "unknown process") Status: ? (you tell me!) The HT log entry is: O4 - HKLM\..\Run: [nosign] C:\WINDOWS\\nosign.exe Argus If anyone could tell me what this is, I'd appreciate it. If it matters, I've found a second executable in my C:\WINDOWS path called mrdel.exe, that was created within minutes of the "nosign" file (in April of 2005). I cannot for the life of me figure what "nosign" does. I'm not overly worried about malware (my wife may have installed something I don't know about), but should I delete these, or at least disable the autorun on "nosign?" I've posted on a few other forums, but no help yet. If anyone could advise, I'd be appreciative. |
|
|
|
Jan 12 2006, 12:21 AM
Post
#2
|
|
![]() SPAM Magnet ![]() ![]() ![]() ![]() ![]() ![]() Group: Global Moderator Posts: 13,800 Joined: 6-May 04 From: SW Louisiana Member No.: 363 |
This is all I could find on nosign.exe.
nosign.exe UNSAFE Application/Process Description I couldn't find anything on mrdel.exe, which is usually a bad sign. I suggest you post a HijackThis log for examination, just to be sure you're infection free. Read How to post a HijackThis Log. Please read, and follow, all directions carefully. Then, run a log, and post it in the HijackThis forum, at this link. Do not, fix anything, yet. A member, of the HJT Team, will help you out. It may take a while to get a response, because the HJT Team are very busy. Please, be patient, these people are volunteers. They will help you out, as soon as possible. NOTE: Once you have made the post, please, DO NOT make another post in the HJT forum, until it has been responded to by a member of the HJT Team. The first thing they look for, when looking for logs to reply to, is 0 replies. If you make another post, there will be 1 reply. The team member, glancing over the replies, might assume someone is already helping you out, and will not respond. So, just make your post, and let it sit there, until a team member responds. This way you will be taken care of, in the most timely manner. -------------------- I love being married.
It's so great to find that one special person you want to annoy, for the rest of your life. |
|
|
|
Jan 12 2006, 01:33 AM
Post
#3
|
|
|
New Member ![]() Group: Members Posts: 4 Joined: 11-January 06 Member No.: 50,240 |
Thanks, I've posted it. I think I'm ok, but it never hurts to let the experts look it over.
|
|
|
|
Jan 12 2006, 07:45 AM
Post
#4
|
|
![]() SPAM Magnet ![]() ![]() ![]() ![]() ![]() ![]() Group: Global Moderator Posts: 13,800 Joined: 6-May 04 From: SW Louisiana Member No.: 363 |
You're welcome, arioch.
QUOTE .... it never hurts to let the experts look it over. Exactly.Better safe, than sorry. -------------------- I love being married.
It's so great to find that one special person you want to annoy, for the rest of your life. |
|
|
|
Jan 12 2006, 05:00 PM
Post
#5
|
|
![]() Bleep Bleep! ![]() ![]() ![]() ![]() ![]() ![]() Group: Admin Posts: 29,355 Joined: 24-January 04 From: USA Member No.: 3 |
Actually can you submit the nosign.exe file to http://www.bleepingcomputer.com/submit-malware.php
-------------------- Lawrence
|
|
|
|
Mar 8 2006, 05:44 PM
Post
#6
|
|
|
New Member ![]() Group: Members Posts: 1 Joined: 8-March 06 Member No.: 58,424 |
argus makes digital cameras... i found this trying to figure out the same thing... i knew what it was [not a clue what it does though
|
|
|
|
![]() ![]() |
| Lo-Fi Version | Time is now: 20th November 2008 - 12:20 PM |