geercon

"Application has changed since the last time you opened it, process
id: 4294808605
Filename: C:\Program Files\Qualcomm\Eudora\Eudora.exe
The change was denied by user.

---- Modules changed: 0 ----
---- New modules: 4 ----
C:\WINDOWS\SYSTEM\KSUSER.DLL
C:\WINDOWS\SYSTEM\CFGMGR32.DLL
C:\WINDOWS\SYSTEM\DSOUND.DLL
C:\WINDOWS\SYSTEM\QUICKTIME.QTS"

There four files were added to my computer, prompting a warning from
Sygate. How do I examine these files to see whether they are legit
updates, or files imposed by penetration through my e-mail client?

han broekman

At least the first and last are legitimate. Did you install Apple
Quicktime?

--
Best regards
Han
email address is invalid

geercon

yes i did

geercon

I've had Apple Quicktime for a while. The four files were all detected
as brand new to my system by Sygate. I detected Verio as the source of
the files by its IP address using ARIN. What has Verio to do with
Apple quicktime? Whe the files coming for Apple, two months later, and
with no notice from Apple, the quicktime program or any source except
Sygate and as a warning at that that they were being installed? I
don't think you guys know the score.

ogden johnson iii

I'm not sure of the score, or who's keeping it. But here's what I
found on my computer, under XPPro.

[Extract from] Directory of c:\Windows\System32

08/18/2001 08:00 16,896 CFGMGR32.DLL
12/12/2002 00:14 336,384 dsound.dll
12/12/2002 00:14 4,096 ksuser.dll
10/10/2002 20:17 4,474,368 QuickTime.qts

The tool-tips of the icons associated with these files identify them
as:

CFGMGR32.DLL - Configuration Manager Forwarder, MS Corporation
dsound.dll - Direct Sound, MS Corporation
ksuser.dll - User CSA Library, MS Corporation
QuickTime.qts - QuickTime.

The date on QuickTime is consistent with the time on most of the
QuickTime files on my computer, so probably represents my last
download/installation of QuickTime.

The 8/18/2001 date is consistent with a lot of the MS DLLs, etc., on
my computer, and probably represents that this is the original file as
installed on my computer by Dell, since I bought/received this
computer in May of 2002.

The 12/12/2002 date on dsound.dll and ksuser.dll probably represent an
update downloaded from MS when it was released. [I'm on Auto Update
notification, and other than the SP1 update which I haven't done, have
installed all "Security" updates, and most of the other updates that I
consider useful to my needs.

So my input, for any scoring system you are using, would be
"No, they are not legit Eudora updates[???], since none of the four
are Eudora files. Three of them are Microsoft, at least putatively
[and on my machine], files and the other is a QuickTime, again at
least putatively [and on my machine], file.

Then we come to another question. What OS are you operating. If it
is either XPPro or XPHome [since I suspect that the odds are both
versions use the same three DLLs] and you have updated your XP
regularly, then if the three MS files don't differ in size or date
from what I show above, then you're probably safe, and you could chalk
this up to a Sygate hiccup. Other, of course, than the fact that mine
are located in C:\Windows\System32 and yours are in C:\Windows\System.
Which is why the question as to what OS are you operating.

At any rate, since none of the files involved are Eudora's, the people
you should start querying are either Sygate tech support or a Sygate
newsgroup on Usenet.

One final note. Verio is, or at least was until a couple of years
ago, a major supplier of internet lines to businesses and to small
ISPs. We [my former and my new company] were customers of theirs at
one time for T-1 lines. They have no connection with Apple,
QuickTime, Qualcomm, or Eudora, except possibly as customers using
their software. However, if your ISP is, as your email addy suggests,
alltel.net, then alltel.net might be one of Verio's customers, and the
source of the IP that Sygate traced to Verio. Pure speculation, of
course, but until you check this out with Sygate, I have nothing
better to do than speculate how three Microsoft *.dlls and an Apple
QuickTime file showed up on their warning list, and why Sygate could
tracked them back to Verio.

OJ III