Windows Forum

Ask something
Discussion Locked

What are these?

0 helpful
5 replies

by daz'n'ash

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

In msconfig I see in the startup section where it lists all the programs starting with windows, what are the following programs?
ctfmon
PTSNOOP

I am not at all concerned about windows being slow to boot, that is not a problem in this system with 1.8 GhZ CPU and 256 MB DDR ram. It runs quite well. I am just curious what these are.

5 replies

by vinnyd

Ptsnoop is a simple backdoor program written in Visual Basic. Being activated it first looks for active RAS connections and exits immediately if none is found.

If a connection is present, the backdoor installs itself to system by copying itself as PTSNOOP.EXE file to \Windows\System\ directory and modifying WIN.INI file. The backdoor adds its execution string after LOAD= variable in [Windows] section of WIN.INI file. Diring this operation WIN.INI file gets copied to WIN.ANA file, the backdoor's execution st ring is then added and WIN.INI file is deleted. Then WIN.ANA file is renamed to WIN.INI file. This way the backdoor will become active every time Windows starts.

Ctfmon.exe activates the Alternative User Input Text Input Processor (TIP) and the Microsoft Office Language Bar.

You can learn more on ctfmon.exe with MS tech article Q282599

by daz'n'ash

Thank you for the answer. After I posted it I remembered to look at MSKB site and I found the ctfmon and what it does. Now, I need to know how can I safely remove the PTSNOOP? If you like, you can email me directly with an answer if you have one. tuituckta@yahoo.com
Thanks again for your help.

by dklippert

CTFMON here's the MS answer:

What Is CTFMON and What Does It Do? Q282599

http://tinyurl.com/16is

PTSNOOP looks at COM ports and loads modem drivers if needed. If you uncheck PTSNOOP it will reload itself. It is not "Spyware"

by daz'n'ash

Thanks for your reply, I appreciate you answering me. I actually looked at the MSKB article after I posted the question. I forgot to check it before writing the question. Ha ha. Any idea how to remove the PTSNOOP file?

This discussion is closed to new replies.