Win 98 PTSNOOP/Pctptt/wiock32 problems

[CanadianTek]

Hey folks..

I have scanned this system with AVG, now clean in both Safe and Normal Modes
Ad-aware, supposedly all fixed
Spybot all clean
Bazooka says.. just ms media player guid
put zone alarm in.. added spyware guard and spyware blaster for good measure

BUT

on reboot.. there is ptsnoop.exe and pctptt.exe sitting in msconfig

so i found removed from msconfig, found the offending files in c:\windows\system.. deleted them,

emptied temp internet files,

empty recycling bin

connected to the net.. boompf..

said cyp.exe and fobush.exe wanted access to the net.. DENY

went in.. deleted them from root..

scanned and cleaned ms config.. and removed every entry associated with CountrySelection (pctptt.exe) and PTSNoop (ptsnoop.exe)

ran ad-aware .. said it found vx2

ran vx2finder .. found a80e1d21-2075-11d9-9e58-0090d0456af3 removed it..

not being 100% satisfied..

i loaded up spysweeper and reg mechanic.. all looked good..

went into reg edit.. removed EVERY occurance of this, ptsnoop, pctptt.exe

by reading the registry i found that vx2 was tied to bw.exe in temp, deleted that,
found it also tied to wjock32.dll and wdock32.dll got rid of them too..

rebooted, in safemode

ran adaware se .. again.. found wcock32.dll and inetfuel.exe and edow.exe and a new entry called wiock32.dll (so what ever is in this system is morphing the names.. on reboot.. ??)

i ticked them all and said.. Next, Next to quarantine then delete..

adaware said.. removed it..


but as soon as i went into windows explorer.. boomphfff there it was
tried to delete wcock32.dll got no protest, gone,
tried to delete its parnter wiock32.dll it said it was part of the system file,

crossrefernced it to a second win 98 se system i have.. and no wisock32.dll wsock32, yes, but not wisock32.dll

so i tried to delete it.. said it was in use by o/s win 98se

so i went to safe mode

said i couldnt delete it its a system file

booted into dos mode

went in.. found the file in c:\windows\system

said attrib wisock32.dll -shr

then copied it to a floppy just in case it REALLLY was an important o/s file
deleted if from pc

rebooted..

into normal mode..

on power up..

spysweeper narcs out saying ptsnoop.exe and pctptt.exe BOTH want to add themselves to the msconfig..

i of course say.. DENY

it says cool

at wits end.. i decide, hey.. time to run hjt, maybe the gurus at pctechforums will see something obvious that im missing..

sooooooooo

here you go..

Logfile of HijackThis v1.98.2
Scan saved at 5:27:04 PM, on 11/10/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\TEKS2GO UTILITIES\AVG ANTIVIRUS\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\TEKS2GO UTILITIES\AVG ANTIVIRUS\AVGCC32.EXE
C:\TEKS2GO UTILITIES\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\ALCATEL\SPEEDTOUCH USB\DRAGDIAG.EXE
C:\TEKS2GO UTILITIES\SPY SWEEPER\SPYSWEEPER.EXE
C:\COREL\SUITE8\PROGRAMS\DAD8.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\TEKS2GO UTILITIES\SPYWAREGUARD\SGMAIN.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\TEKS2GO UTILITIES\SPYWAREGUARD\SGBHP.EXE
C:\TEKS2GO UTILITIES\HIJACKTHISV1-98-2.EXE

R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG_CC] c:\TEKS2G~1\AVGANT~1\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Teks2Go Utilities\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\RunServices: [Avgserv9.exe] c:\TEKS2G~1\AVGANT~1\Avgserv9.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [SpySweeper] "C:\Teks2Go Utilities\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - HKCU\..\RunServices: [SpySweeper] "C:\Teks2Go Utilities\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - Startup: Corel Desktop Application Director 8.LNK = C:\Corel\Suite8\Programs\DAD8.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: SpywareGuard.lnk = C:\Teks2Go Utilities\SpywareGuard\sgmain.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll


my only suspicions are the R3 and the O12 ??? but i was hoping one of you folk would know more.. or see something.. ive missed..

thanx
CT

[Cactus]

Here's the only bad entry in your logfile:

R3 - Default URLSearchHook is missing

Have HJT fix it.

FYI:
Ptsnoop.exe
http://www.sysinfo.org/startuplist.php? ... unt=&type=

Then read this...
http://www.f-secure.com/v-descs/ptsnoop.shtml


Cactus

[PCguy]

I have seen this before. Nobody can catch it but EScan. Try it.

[lilpinkflower]

[Cactus]

That's not entirely true lilpink sry ...
Here are the reasons you could have them on your pc!!!

(1) Program installed with some modems that monitors the COM ports for the modem driver. Not required from what I've read - may need a registry edit to get rid of it

(2) Backdoor trojan virus that copies itself as PTSNOOP.EXE -see for more info

(3) Apparently the people who put it out claim it's a driver for a Voice modems (don't know who they are though - Ed)
Note: If using AOL and you disable this you may lose your connection or lock up

(4) Can also be an older Logitech scanner program. Remove from the Win.ini tab under Load='path'PTSNOOP and the System.ini tab under drivers='path'ptrtkr.drb. Can cause parallel port conflicts big time dragging system resources way down when a conflict exists

(5) Allows audio monitoring of modem phone dialling tones and can be useful if you have connection problems

(6) Karen Kenworthy's - "logs the start and stop time of all programs run under Windows"

Info Source:
http://www.sysinfo.org/startuplist.php? ... unt=&type=

Cactus

[lilpinkflower]

I would only be worried about (2).... and isn't there a way of finding out whether it is a trojan or not ?

As far as I can see it was only noticed in msconfig... not as something causing a problem. I had both ptsnoop and pctptt.exe running on my old computer and researched them especially the ptsnoop.... and they seemed harmless to me. The pctptt.exe is just 'country selection' and you have posted about what ptsnoop is.

lilpink x

I just think that 'fiddling' sometimes causes more problems than the trouble that was caused in the first place ..... I hold my hands up if it turns out to be a trojan though.... but there seems no sign of anything nasty ?

[CanadianTek]

Thank you for your inputs.. all of you.. really.., very muchly appreciated..

Here is my take..

I ran Escan (by kaspersky) .. it found a file.. fuxyhh.dll? or fuxyhh.exe .. but said it could not remove it as e-scan is NOT free.. buy and we will clean.. well.. im quite happy with AVG.. and ad-aware, spybot.. etc..

so.. i just read the report..

went and deleted the file ...

checked the disk for hidden or backed up copies.. none..


There is a modem in the system, and yes, it has the ptsnoop files sitting in its install/config directory.. but here is the suspicious part..

I HAVE REMOVED THE ENTRIES FROM THE REGISTRY

I HAVE REMOVED THE FILES FROM THE HD DRIVE.. (just the 2 ptsnoop.exe and pctptt.exe) ...

I emptied the trash basket..

AND

Removed the entries from msconfig

IF.. it was just a modem program.. i would think that would be the end of it..

if the modem reallllllllllllllllllly needed them.. it would have barfed out an error message or put a missing file error message on the page.. or .. an exclamation mark in dev manager.. (at least that is my thought)...

yet.. oddly when i originally went into DEV MANAGER, opened the modem and looked at all its resources.. etc..

it listed about a dozen files..

all in capital letters..

PT
blah blah blah

then

ptsnoop.exe
pctptt.exe <<< both in lower case letters.. both with install/creation dates.. 2 or 3 years after the modem original install dates.. :S (what up with that?? )

so my suspicions were.. they were added after the fact, whether it be a trojan.. ? or.. a spy .. i dont know..

i know when i do reboot.. BOOMPF.. spysweeper says. .HEY these two files are being added.. ptsnoop.exe and pctptt.exe to your msconfig.. keep them or remove them.. i say remove.. (i dont think a standard pci modem has that kind of autoboot registry smarts would it? .. not without first running (autorunning ??) new hardware wizard - which it does not.. do ..

now this system did have a whole mess of things going in..

most of which.. spybot, ad-aware, bazooka, reg mechanic and spy sweeeper have all made quick work of correcting..

but im just obsessed that this ptsnoop thing is not the legit thing.. (maybe im wrong.. but i aim to learn.. albeit a little obsessive.. perhaps)

so i poked around in HJT.. and wondered about the Config.. etc.. and found this in the host files..

now i did some google searches.. and every body sorta kinda beat around the bush..

i was hoping to find somebody who would come out and say..

"your host file should only have 127.0.0.1. local host" in it, all others are bad or wrong

but alas.. could not quite find any such committed opinion..

here is what the host file does have..


127.0.0.1 www.igetnet.com
127.0.0.1 code.ignphrases.com
127.0.0.1 clear-search.com
127.0.0.1 r1.clrsch.com
127.0.0.1 sds.clrsch.com
127.0.0.1 status.clrsch.com
127.0.0.1 www.clrsch.com
127.0.0.1 clr-sch.com
127.0.0.1 sds-qckads.com
127.0.0.1 status.qckads.com

plus 2 more lines.. something to the effect of..

#start entries by spybot.. blah blah blah
#stop entries by spybot..blah blah blah... <<<nothing in between them

so upon looking into that.. it sounded more like.. a neat place that spybot would either a) place its exceptions.. or b) place sites it knows to block??

so i still dont know if having a host file is good.. or bad.. :S

should it be blank..

AND YES.. if you look it has no ... localhost line in it...

..final note this system had had vx2 in it.. yet when i ran vx2finder it only came up with the one A80E1D21-2075-11D9-9E58-0090D0456AF3 string.. in .. hk current user?

so i told it to delete, did the restore registry.. thing.. etc..

BUT.. before i rebooted, being cautious.. and knowing of the chameleon like tendencies of spies to bury multiple copies in the registry...

i went in by hand via reg edit and deleted 2 or 3 more references... to that same string..

A80E1D21-2075-11D9-9E58-0090D0456AF3

while in there.. i again when thru and deleted all references to ptsnoop.exe CountrySelection ... and pctptt.exe

then rebooted..

boompf

spy sweeper says ptsnoop.exe and pctptt.exe want to be added to your msconfig, i said deny..

went back into hjt... just to check for any changes on the host file,

still the same..

127.0.0.1 www.igetnet.com
127.0.0.1 code.ignphrases.com
127.0.0.1 clear-search.com
127.0.0.1 r1.clrsch.com
127.0.0.1 sds.clrsch.com
127.0.0.1 status.clrsch.com
127.0.0.1 www.clrsch.com
127.0.0.1 clr-sch.com
127.0.0.1 sds-qckads.com
127.0.0.1 status.qckads.com

#start entries by spybot.. blah blah blah
#stop entries by spybot..blah blah blah... <<<nothing in between them

let me know if host entries are good? or bad?

if bad.. which ones should i remove?

(and yes, God willing.. i hope to sit down this weekend and start taking TomCoyote's classes on .. HJT)....

again.. many .. thanx.. feedback /... appreciated..

CT

[lilpinkflower]

When I used escan it cleaned...no problem ! It was a while back though.

I can't even begin to answer your questions... but I'm very interested in your post... because I worried about ptsnoop once too.

Good luck !!

lilpink x

[Cactus]

Run HJT again and post a fresh logfile.

Cactus

[Geekgirl]

I agree, posting a new HJT logfile will help our moderator to resolve your problems

[CanadianTek]

I went in and cleaned all the entries out of the Hosts file

rebooted, ... rescanned.. with adaware, spybot and spysweeper..

and i finally resolved to let the ptsnoop.exe and pctptt.exe stay in the msconfig

but gone was the miscellaneous names.. being dropped in the windows (or windows \ system ) directory..

(the wjock32.dll and wdock.dll .. and on a separate boot.. wiock32.dll and wcock.dll nothing of the like returned.. and you will notice the only character that changed in the file names was the second letter in..odd little behaviour pattern)..

gone also was the fobush, cyp, inetfuel and edow entries..

which always seem to dump themselves in the root directory..

do i believe the problems are gone.. ? for now.. yes..

2 or 3 reboots didnt seem to produce any new re-occurances..

was ptsnoop necessary drivers? hmm tuff call.. but after spending soo much time on it.. im just tooo busy to spend anymore.

i took a quick glance at the hjt.. but did not see any out of the ordinairy

.... i cant help but feel i may have given up on this one too early.. but there are only so many hours in the day.. / week.. as i said.. i gave in to letting pctools and pctptt both stay in the msconfig.. and all so far seems to be ok.. (i know if you blow wininit.bak away.. the wininit. exe will recreate a new one? ..just curious if the same holds true for these pcsnoops.. i just have no clue.. but am content there nothing else seems to be creeping into the system)

thanx all for your help..
CT