PDA

View Full Version : Help - deleting start up items



Bonnie
2006-01-27, 18:47
On the start up items in Spybot SD, when I clicked on the buttons for description it says:
Filename: system 32.exe added by AGOBOT-KU worm has a blank entry under the start up item/name field.
Also have one for:
C\Windows\system32\Ctfmon.exe The description says: Coolweb Search parasite related - hijacking to slawsearch.com
I have un-checked these items. I only highlighted one item, then I clicked on the red X to delete it, A message came up saying I had chosen to delete these items - yes or no ...It scared me, I didn't know if it was going to delete everything or just the item I had highlighted - so I clicked no and decided to come here.
Also, Spybot SD did not detect these items and give me a choice to fix. I downloaded the latest detections today and ran it. I also did a full scan with Norton Anti Virus and also with Adaware SE PLUS -nothing shows up????

This AGOBOT-KU showed up after I installed TurboTax Deluxe and I couldn't download the latest updates and the Calif. State Tax program, it would only go to 12%. I got on the TurboTax site and read what they said about it - They said to stop your firewall and anti virus program, then download it and restart the programs. I didn't do that, but I did go into the Firewall and click permit all for both TurboTax settings, then they downloaded alright. Have you heard anything about TurboTax installing spyware with their program?
I have Windows XP Home with sp2 with automatic updates.

Any help will be greatly appreciated, thank you. Bonnie

md usa spybot fan
2006-01-27, 18:58
For the Ctfmon.exe see:
Ctfmon.exe
http://forums.spybot.info/showthread.php?t=324

It really is not necessary as a startup entry as the Paul Collin's listing indicates with "Not Required" in addition to indicating it can be a virus etc.

For more information see:
Frequently asked questions about Ctfmon.exe
http://support.microsoft.com/default.aspx?scid=kb;en-us;282599

Bonnie
2006-01-28, 18:43
I am in Spybot SD, in the start up section...I want to delete something from starting up..Do I click on the item and that highlights it, then do I click on the red X ? Then a pop up window says something like "You have chosen to delete these items" "yes or no".... I click on yes?
And it only deletes the item I clicked on and highlighted - right??? It doesn't delete anything else>

I am probably overly cautious, but deleting things scare me!
Thank you, Bonnie

md usa spybot fan
2006-01-28, 18:57
re: This message in Spybot's System Startup
Confirmation
You are about to remove these entries. Do you want to continue?
Yes No
Scary message. In spite of the plural "entries" only the single highlighted entry is deleted if that is all you highlighted.

Bonnie
2006-01-29, 17:04
Thank you! You guys do such an excellent job with your explanations and help.
Has anyone heard of this "AGOBOT-KU worn?
On the start up items in Spybot SD, when I clicked on the buttons for description it says:
Filename: system 32.exe added by AGOBOT-KU worm "has a blank entry under the start up item/name field."

I did a Google check on it and there were quite a few entries saying the same thing as above.