|
-
March 15th, 2010, 01:38 PM
#1
Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to Show hidden files, and folders.
Upload following files to http://www.virustotal.com/ for security check:
c:\windows\system32\ctfmon.exe
If the file is listed as already analyzed, click on Reanalyze button.
Post scan results.
-
March 15th, 2010, 01:57 PM
#2
Virus total scan
I did have to click "reanalyze"...
File ctfmon.exe received on 2010.03.15 17:54:17 (UTC)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/42 (0%)
Loading server information...
Your file is queued in position: 2.
Estimated start time is between 49 and 70 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.
You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email:
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.03.15 -
AhnLab-V3 5.0.0.2 2010.03.15 -
AntiVir 8.2.1.180 2010.03.15 -
Antiy-AVL 2.0.3.7 2010.03.15 -
Authentium 5.2.0.5 2010.03.15 -
Avast 4.8.1351.0 2010.03.15 -
Avast5 5.0.332.0 2010.03.15 -
AVG 9.0.0.787 2010.03.15 -
BitDefender 7.2 2010.03.15 -
CAT-QuickHeal 10.00 2010.03.15 -
ClamAV 0.96.0.0-git 2010.03.15 -
Comodo 4274 2010.03.15 -
DrWeb 5.0.1.12222 2010.03.15 -
eSafe 7.0.17.0 2010.03.15 -
eTrust-Vet 35.2.7363 2010.03.15 -
F-Prot 4.5.1.85 2010.03.15 -
F-Secure 9.0.15370.0 2010.03.15 -
Fortinet 4.0.14.0 2010.03.15 -
GData 19 2010.03.15 -
Ikarus T3.1.1.80.0 2010.03.15 -
Jiangmin 13.0.900 2010.03.15 -
K7AntiVirus 7.10.998 2010.03.15 -
Kaspersky 7.0.0.125 2010.03.15 -
McAfee 5921 2010.03.15 -
McAfee+Artemis 5921 2010.03.15 -
McAfee-GW-Edition 6.8.5 2010.03.15 -
Microsoft 1.5502 2010.03.12 -
NOD32 4946 2010.03.15 -
Norman 6.04.08 2010.03.15 -
nProtect 2009.1.8.0 2010.03.15 -
Panda 10.0.2.2 2010.03.15 -
PCTools 7.0.3.5 2010.03.15 -
Prevx 3.0 2010.03.15 -
Rising 22.39.00.04 2010.03.15 -
Sophos 4.51.0 2010.03.15 -
Sunbelt 5898 2010.03.15 -
Symantec 20091.2.0.41 2010.03.15 -
TheHacker 6.5.2.0.233 2010.03.15 -
TrendMicro 9.120.0.1004 2010.03.15 -
VBA32 3.12.12.2 2010.03.14 -
ViRobot 2010.3.15.2228 2010.03.15 -
VirusBuster 5.0.27.0 2010.03.14 -
Additional information
File size: 24064 bytes
MD5...: c3a2915c71ae6f225eb906c25ccd29b5
SHA1..: 1cf5830c4870e9c898ca2405a9bffd3e262951c8
SHA256: e70818d0dc35a6aaf26c2d48a74f98509f9d0c53cfa1ab604cf47532f044010f
ssdeep: 384:e8NcccLxxfAA2BwRyb1vL11j9rCzlagxvY1NvJmlTZgO:e8ehLfAjhBT11j9
mRaglOslTqO
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x1028
timedatestamp.....: 0x48353dd4 (Thu May 22 09:33:08 2008)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3bb8 0x3c00 6.58 59c51a38dacc13381152af9207eb91db
.rdata 0x5000 0x121a 0x1400 4.50 01373b9a6d623aded004dd1276f8d82c
.data 0x7000 0x858 0x400 2.13 b5d87e54f49741bb78b88012aacb4d30
.rsrc 0x8000 0x418 0x600 2.48 b02570ee42377c71d5bca68d75c2ba72
( 1 imports )
> KERNEL32.dll: GetModuleHandleA, GetCommandLineA, GetVersionExA, ExitProcess, GetProcAddress, TerminateProcess, GetCurrentProcess, WriteFile, GetStdHandle, GetModuleFileNameA, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetLastError, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStartupInfoA, HeapDestroy, HeapCreate, VirtualFree, HeapFree, LoadLibraryA, HeapAlloc, GetACP, GetOEMCP, GetCPInfo, VirtualAlloc, HeapReAlloc, RtlUnwind, InterlockedExchange, VirtualQuery, HeapSize, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, VirtualProtect, GetSystemInfo
( 0 exports )
RDS...: NSRL Reference Data Set
-
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
pdfid.: -
sigcheck:
publisher....: Gerhard Schlager
copyright....: Copyright (c) 2002-2008 Gerhard Schlager
product......: Dummy CTFMON.EXE (part of the CTFMON-Remover)
description..: Dummy to replace the annoying CTFMON.EXE
original name: CTFMON.EXE
internal name: n/a
file version.: 1.0.0.5
comments.....: http://www.gerhard-schlager.at/projects/ctfmonremover/
signers......: -
signing date.: -
verified.....: Unsigned
-
March 15th, 2010, 02:06 PM
#3
Virustotal take two
I ran this again when I saw the info at the top (after I copied and pasted)indicating the scan was stopped, etc., as it said finished the first time I ran it and before I copied.....same thing happened. The scan DID finish completely - not sure where the wording at the top is coming from as it's not on the screen, but....
File ctfmon.exe received on 2010.03.15 18:02:00 (UTC)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/42 (0%)
Loading server information...
Your file is queued in position: 2.
Estimated start time is between 49 and 70 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.
You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email:
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.03.15 -
AhnLab-V3 5.0.0.2 2010.03.15 -
AntiVir 8.2.1.180 2010.03.15 -
Antiy-AVL 2.0.3.7 2010.03.15 -
Authentium 5.2.0.5 2010.03.15 -
Avast 4.8.1351.0 2010.03.15 -
Avast5 5.0.332.0 2010.03.15 -
AVG 9.0.0.787 2010.03.15 -
BitDefender 7.2 2010.03.15 -
CAT-QuickHeal 10.00 2010.03.15 -
ClamAV 0.96.0.0-git 2010.03.15 -
Comodo 4274 2010.03.15 -
DrWeb 5.0.1.12222 2010.03.15 -
eSafe 7.0.17.0 2010.03.15 -
eTrust-Vet 35.2.7363 2010.03.15 -
F-Prot 4.5.1.85 2010.03.15 -
F-Secure 9.0.15370.0 2010.03.15 -
Fortinet 4.0.14.0 2010.03.15 -
GData 19 2010.03.15 -
Ikarus T3.1.1.80.0 2010.03.15 -
Jiangmin 13.0.900 2010.03.15 -
K7AntiVirus 7.10.998 2010.03.15 -
Kaspersky 7.0.0.125 2010.03.15 -
McAfee 5921 2010.03.15 -
McAfee+Artemis 5921 2010.03.15 -
McAfee-GW-Edition 6.8.5 2010.03.15 -
Microsoft 1.5502 2010.03.12 -
NOD32 4946 2010.03.15 -
Norman 6.04.08 2010.03.15 -
nProtect 2009.1.8.0 2010.03.15 -
Panda 10.0.2.2 2010.03.15 -
PCTools 7.0.3.5 2010.03.15 -
Prevx 3.0 2010.03.15 -
Rising 22.39.00.04 2010.03.15 -
Sophos 4.51.0 2010.03.15 -
Sunbelt 5898 2010.03.15 -
Symantec 20091.2.0.41 2010.03.15 -
TheHacker 6.5.2.0.233 2010.03.15 -
TrendMicro 9.120.0.1004 2010.03.15 -
VBA32 3.12.12.2 2010.03.14 -
ViRobot 2010.3.15.2228 2010.03.15 -
VirusBuster 5.0.27.0 2010.03.14 -
Additional information
File size: 24064 bytes
MD5...: c3a2915c71ae6f225eb906c25ccd29b5
SHA1..: 1cf5830c4870e9c898ca2405a9bffd3e262951c8
SHA256: e70818d0dc35a6aaf26c2d48a74f98509f9d0c53cfa1ab604cf47532f044010f
ssdeep: 384:e8NcccLxxfAA2BwRyb1vL11j9rCzlagxvY1NvJmlTZgO:e8ehLfAjhBT11j9
mRaglOslTqO
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x1028
timedatestamp.....: 0x48353dd4 (Thu May 22 09:33:08 2008)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3bb8 0x3c00 6.58 59c51a38dacc13381152af9207eb91db
.rdata 0x5000 0x121a 0x1400 4.50 01373b9a6d623aded004dd1276f8d82c
.data 0x7000 0x858 0x400 2.13 b5d87e54f49741bb78b88012aacb4d30
.rsrc 0x8000 0x418 0x600 2.48 b02570ee42377c71d5bca68d75c2ba72
( 1 imports )
> KERNEL32.dll: GetModuleHandleA, GetCommandLineA, GetVersionExA, ExitProcess, GetProcAddress, TerminateProcess, GetCurrentProcess, WriteFile, GetStdHandle, GetModuleFileNameA, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetLastError, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStartupInfoA, HeapDestroy, HeapCreate, VirtualFree, HeapFree, LoadLibraryA, HeapAlloc, GetACP, GetOEMCP, GetCPInfo, VirtualAlloc, HeapReAlloc, RtlUnwind, InterlockedExchange, VirtualQuery, HeapSize, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, VirtualProtect, GetSystemInfo
( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
sigcheck:
publisher....: Gerhard Schlager
copyright....: Copyright (c) 2002-2008 Gerhard Schlager
product......: Dummy CTFMON.EXE (part of the CTFMON-Remover)
description..: Dummy to replace the annoying CTFMON.EXE
original name: CTFMON.EXE
internal name: n/a
file version.: 1.0.0.5
comments.....: http://www.gerhard-schlager.at/projects/ctfmonremover/
signers......: -
signing date.: -
verified.....: Unsigned
Thread Information
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|
Reply With Quote
