KB934238 - file is printfilterpipleline.exe

[David Sherman]

Microsoft releaseed KB934238 today.

I wonder why one of the files is calling home to the following
address:

WhoIs Lookup performed by Karen's WhoIs
http://www.karenware.com/

OrgName: Level 3 Communications, Inc.
OrgID: LVLT
Address: 1025 Eldorado Blvd.
City: Broomfield
StateProv: CO
PostalCode: 80021
Country: US

NetRange: 4.0.0.0 - 4.255.255.255
CIDR: 4.0.0.0/8
NetName: LVLT-ORG-4-8
NetHandle: NET-4-0-0-0-1
Parent:
NetType: Direct Allocation
NameServer: NS1.LEVEL3.NET
NameServer: NS2.LEVEL3.NET
Comment:
RegDate:
Updated: 2004-06-04
OrgAbuseHandle: APL8-ARIN
OrgAbuseName: Abuse POC LVLT
OrgAbusePhone: +1-877-453-8353
OrgAbuseEmail: (e-mail address removed)

OrgTechHandle: ARINC4-ARIN
OrgTechName: ARIN Contact
OrgTechPhone: +1-800-436-8489
OrgTechEmail: (e-mail address removed)

OrgTechHandle: TPL1-ARIN
OrgTechName: Tech POC LVLT
OrgTechPhone: +1-877-453-8353
OrgTechEmail: (e-mail address removed)

# ARIN WHOIS database, last updated 2007-04-24 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

 

[Guest]

You don't mention who is listed as the maker in file properties/Version tab.
I would guess the MS team failed to recomplie and sign the file, and the
original authors cert is still being used to authenticate the hotfix.

 

[David Sherman]

It is a Microsoft file called "Print filter Pipeline Host.