Tom's Guide | Tom's Hardware | Tom's Games
![]() |
![]() |
![]() |
I found this loading up in my system.ini
and was wondering what type of program it is
before I disable it.

ptsnoop.exe is a TSR used by your modem. Disabling it would be a bad Idea. However, that particular TSR can be a pain in the *ss, resource wise. If your modem is ancient, like a 28.8, consider replacing it.

I found this program also in my Win.ini file. However, my modem is the new 56K. Do I really need it?

The file Ptsnoop.exe is used by PCTEL HSP
modems, which are very resource hungry to
check that all needed drivers are correctly
loaded at time of trying to go online.
HSP modems use the CPU to do all the hard work and are intended for use with a Pentium processor. It is worth noting that a Cyrix below P133 will not even manage to maintain a conection using one of these beasts.
good luck :-)
/\/\ega\/olt

I found the same thing, and I removed it from my win.ini file. I am online to see how my connection behaves.

I have disabled and removed this from my system. Deleted the reference from my win.ini file and the registry and the windows dir. So far so good hope I dont have any more problems. After I removed this file and stopped it from loading my internet connection seemed to speed up 10 times or more. Where can I find documentation on ptsnoop?

I too have disabled ptsnoop and am using my HSP 56k MicroModem. Every time my Win98 system crashed, ptsnoop.exe seemed to be part of the problem. So far, so good. I only lost the sound for modem dialing and handshaking, but I need to experiment more.

I also have a HSP 56k, every time windows crashes, This app is loaded.
I removed it from my win.ini too.
Thanks to all.

Looks like my modem connection hangs up every time the system loads ptsnoop back. I have a 56K modem. Seems that this ptsnoop is something to get rid of.

Hey, I'm using an HSP 56K modem too. Is it built in to the mainbord for all you guys too? Or a riser-card type thing? (Not a standard PCI-or-ISA slot modem.) Do you all think I should remove ptsnoop.exe also? I saw it in the 'Close Program' dialog of win95, and was afraid somebody was trying a netbus-type thing on me. (That's how I found this thread :-) Anyways, if anybody has suggestions for me, please e-mail me, or post (prefferably e-mail).
~ Steven

I found this program also in my Win.ini file. However, my modem is the new 56K. Do I really need it?

I have noticed that ptsnoop is also running on my system, after doing some research on the net I have learned that ptsnoop is a trojan and should be sweeped.

I thought this was a trojan, panicked & removed the reference from my win.ini file, also taking the .exe proogram out too!! I too have a pc chips board with micro modem, like many others here so I guess its connected with that...I hope! If anyone else is worried about trojans, I recommend Regrun2. And its shareware. A good trojan buster/dectector.

Found this thread using Altavista after I too found PTSNOOP installed on my computer at home. Since it had loaded itself secretly in the background without me knowing I got a bit paranoid, thinking it was something along the lines of Back Orifice. So I removed it and deleted pointers to it in other files as mentioned by others above this message. Also deleted the ptsnoop.exe! I think it is really rude of a modem manufacturer to run a "hidden" program like that, no matter how helpful they intended it to be.
Anyhow, just wanted to add my 2 pence! :o)
Ashley.

Deleted PTSnoop.exe, but also noted several other files that I did not notice before. These were: OSA (seems to be an autosave macro for Excel that brings up a virus warning), LoadWC (application), and files named act@download and act@avenea. So being impatient I deleted them all.
Any ideas what might be going on? Perhaps a suite of files that accomplish the trojan purposes?

I have the ptsnoop also. What I was wondering was- of all the people that deleted it and it's associats, are they stil running? and is it in the same running condition? and exactly what does it do, in layman terms- any answers can be e-mailed to me with great appreciation to--THENEWGUROO@aol.com"

I have the ptsnoop also. What I was wondering was- of all the people that deleted it and it's associats, are they stil running? and is it in the same running condition? and exactly what does it do, in layman terms- any answers can be e-mailed to me with great appreciation to--THENEWGUROO@aol.com"

When i started up my computer pt snoop gave me an error because i connected up to a network, not a modem. I deleted it from my win.ini file and nothing seemed to have changed, except i don't get the error message anymore. It is not a trojen, its just a hidden driver that the modem uses. If you delete it it might actually go faster, but don't blame me if there are any side effects.

I have, supposedly, a very good ani-virus software, Norton SystemsWork v.3.0, and ptsnoop.exe was not detected. Are there any "off the shelf" anti-virus software that can detect AND clean this bug? Also, how DO you erase ptsnoop.exe?

I had the Ptsnoop also,
I do NOT have an HSP modem,
but I used to! So it didn't remove
the ptsnoop program from the win.ini,
why not? lame ass shit,
I didn't see any change in my dial-up performance after removing it.
I don't think it's a trojan, nope,
nothing comes up at CAI, so I wouldn't worry
about it being a trojan.

Symentec gives instructions for removing ptsnoop at http://service1.symantec.com/SUPPORT/qdeckkb.nsf/75b748eaf2eca601852566d60070f93d/06d8439c1d3d76e7852566d00010eb3b?OpenDocument

ptsnoop seems to have something to do with hsp? modems, but if you are like me (only wanting minimum programs running in the background) then delete it,but put it on a floppy first! I did this 2 years ago and have had no problems!!!

ptsnoop seems to have something to do with hsp? modems, but if you are like me (only wanting minimum programs running in the background) then delete it,but put it on a floppy first! I did this 2 years ago and have had no problems!!!

ptsnoop.exe is nothing like told above. My friend's system ran the program auto and we deleted it. Nothing happened to his connection to the internet. Delete it because it is a spy program, whether trojan or not, somebody is watching you! ôô! Don't try to find the origin or anything else about it, just delete it. Although if problems do occur (which they won't) I will NOT be held responsible.

I have this stinkin' "snoop" thing too, Cyrix chip, also HSP MicroModem. I check out some illicit stuff on the net once and awhile, and I thought maybe it was one of those "FBI" things, sent in to monitor my sojourns into sleazeville; good thing I did a search on it!
The internet is ours to use as we choose, no regulation, no restrictions. I have found out about "online" URL services where you can log into if you are concerned about "big brother" watching you. I am certainly relieved to find that this "snoop" thingy is part of the modem setup, but still I wonder...

This Ptsnoop thingy is some kind of password stealer so im told. It didnt exist on my computer until i received some Trojanworm virus arrrrrr. I suggest u delete it.
=)

I am having trouble removing Ptsnoop from my computer. Whenever I try to it says it is being used by windows. I also tried to stop it from being loaded when windows starts, but it just starts up anyway. I CAN'T GET RID OF IT! Help please.

On Feb 15 Roger Sweeney provided an excellent reference in this thread on the subject of the (removal of?) ptsnoop. Roger, I appreciated your input. I accidentally deleted ptsnoop.exe when reclaiming disc space with McAfee Uninstaller. Subsequently, when restarting my system I would receive an error message stating that ptsnoop.exe could not be located. This was more of a nuisance than a problem, so I decided to see if I could locate help in AltaVista - eventually finding your message. Since following your advice I no longer have the pesky error message, and everything seems to be running fine. Thanks again.

I have no idea why this thing (ptsnoop.exe) just started running... It has been most troublesome, and by my account, does not look legit - it looks like a trojan.
This program appears to have been generating an outbound UDP connection(s)to "http://ads.clickagents.com/cgibin/banner.ca?koksiong.330.iframe&http://members.tripod.com/musiccentury/code1.htm"
There was another "snoopfile" named "ptsnoop.lgc" involved... I opened it with notepad; it appeared to have bunches of information users/user profiles etc.
Paranoid? Maybe. I blew it away nonetheless.

The own PCTel, the manufacturator of the chipset used by refered HSP MOdem, has the answer. Please read:
http://www.users.zetnet.co.uk/shiva/modem/faq.htm
I removed this file from my computer and hasn't exoerienced problemens yet...

If isn't loaded on with win.ini where else could it be? I'm running win2k and it's not on my win.ini. I've already deleted the .exe but I am getting tired of it tring to load it six times.

i also found this on my computer and i didnt know what it was so i deleted it.
i figured is was something my friend put on my computer to snoop on me

What is HSP?
HSP stands for Host Signal Processing. This refers to using the host computers processor (Pentium chip) in place of a dedicated chip on the modem (DSP) to perform the Digital Signal Processing.What is the PTSNOOP.exe program for?
PTSNOOP is a token program that waits for some program to request the COM port to be opened. Then it makes sure that the drivers get loaded. The total memory impact is less than one meg of RAM, for everything that the HSP software does.The problem occurs mainly when you have this type of feature on a very slow pentium, or a Cyrix which is too slow, or incapable of handling HSP - or when you don't have enough ram to handle it.
To fix the problem, do as it has been suggested here, in sys.ini , or win.ini , and if possible in the registry. If it says that Windows/or the system is using that file, find the file, right click it, or go to file and choose "properties". In properties, click on the blocks at the bottom that say "read only". Then restart your computer, then it will allow you to delete it. But, if you must have it, do this: reinstall the drivers and see if it will work better.
About the virus. The closest virus that comes to ptsnoop.exe it's the picture.exe virus, which is the one someone mentioned above coming from porno sites, and the site in tripod.com .
As to the files that looked like act@blahblah.com, and act@blahtwo.com, those are cookies. Cookies will not harm your computer, but they will let malicious website owners to scan some of them to find out about your surfing habits, mainly for marketing.
For information on the picture.exe virus, check this site: http://www.symantec.com/avcenter/venc/data/picture-exe-th.html

I have just had a scare via the Norton Antivirus advising I was infected with PWSteal.Trojan. Having quaranteened the virus I found that it was the PTSNOOP.exe file that was affected and could not be repaired. Having asked friends, none knew or had the PTSNOOP.exe file, so it was removed. Computer seems to operate normally but too early to tell if any long term problems. Loads of investigation on the internet later seems to suggest that PTSNOOP.exe is genuine but not a strictly neccesary file as advised below by Synamtec (relative to: PTSNOOP.exe Interferes with Installation and Running of REALHELP). I am however confused as to where PWSteal.Trojan is or was located. I would appreciate any comments.
QUOTE:
Solution:PTSNOOP.EXE interferes with the proper running of REALHELP. It can also cause interference with the InstallShield process.NOTE: PTSNOOP is a token program that waits for a program to request the COM port to be opened. Then it makes sure that the modem drivers get loaded if they are not.
PTSNOOP can be found with several different modems, such as the MICOM HSP PCTEL and EPS Technology COMM WAVE PCMCIA modems. It is not mandatory for proper operation, and the manufacturers list removal of PTSNOOP in various steps of their troubleshooting procedures.

I just had the same experience as Dave. Updated my Norton AV and scanned and found the PWSteal.Trojan had infected PTSNOOP.exe I deleted it and edited my win.ini Where did this come from?

Add me to the list...I got an alert today for the same trojan, PWSteal.
Interestingly, NAV reports that definitions from 12/99 reported a false alarm for this. I'm suspecting this is probably another of the same.

I too received the virus warning when I updated my Symantec software using the 5/9/2000 patch. I've used the Symantec software (with the PTSNOOP.EXE) for over a year and only now received my first warning. I update my anti virus files at least once a week and never received a warning of the virus back in December. I removed the file entry under LOAD in my win.ini file before finding the forum. It has not caused me any problems. Best of all the Symantec software is not throwing error warnings.

Have a look at http://service1.symantec.com/SUPPORT/nav.nsf/df0a595864594c86852567ac0063608c/67f871cfc418b32a8825686c001bbe31?OpenDocument. According to Symantic, it is difficult to tell if the PTSNOOP.exe contains the virus (PWSteal.Trojan) or not, so I guess it just just flags it up anyway.

I was a victim on the "virus" to! Having deleted the file - where should I look to get a genuine version of it should I ever wish to reinstall?
To date, I have experienced no problems.

I had to delete ptsnoop.exe cuz it was infected with a virus. Now that i did that, every time i boot up, an error comes up. Is there anything i can do to get this error to go away? email me if u have anything that could help. thanx
Dan

You can delete the program simply by going to c:\windows, selecting the "ptsnoop.exe" and press "delete". If it doesn't work, right click on the file, select "properties" and uncheck "read-only". You can now delete it.
When you start your computer, windows will try to load this program and warn you that it is not there anymore. To get rid of this warning, go to "start", "run" and put "msconfig", press "ok". Choose the "start up" tab and uncheck the "load= ptsnoop.exe", press "aply", "ok". You will need to restart your computer and the problem will be fix!

Actually, my Norton Antivirus detected as a Trojan, and make me deleted it, it told me to replaced with a non infected ptsnoop.exe but with what im seeng here i delete the log on the win.ini and it seems to run better!

Got the same Trojan detected in ptsnoop.exe after upgrading the NAV 2000 virus patch.Deleted it from the system ,could not find any record of it in any config file.Not had any error messages yet, everything ok at the moment

I came accross ptsnoop.exe when it became infected with a virus. A trojan virus called 'WSteal' which will steal my passwords and send it to its creator. I was forced to delete this ptsnoop.exe and have just removed it from my win.ini file. So far so good.
It could be a target for trojan viruses. Also ptsnoop.exe was the reason for windows on my computer crashing, so perhaps getting rid of it aint a big deal - it could be a blessing in disguise

After updating NAV 2000 I also received the warning of a "Virus" in ptsnoop.exe and chose to delete it. I then removed the directive to load it in win.ini and re-booted. No problem! Who was that masked man??

I have a PCTEL modem. ptsnoop.exe was infected by PWSteal.Trojan virus. I removed ptsnoop.exe from win.ini. So far, no problem!
Glad to see I'm not alone.

I have a PCTEL modem. ptsnoop.exe was infected by PWSteal.Trojan virus. I removed ptsnoop.exe from win.ini. So far, no problem!
Glad to see I'm not alone.

I booted my computer today and found that every time Windows loaded, my monitor went bonkers. I went into Windows in Safe Mode and could find no problem. But when I came into windows normally, the monitor's freak outs kept happening. During one of the freak outs, I accidentally hit the space bar of my keyboard and the monitor came back to normal. There was a message about deleting Ptsnoop.exe from the load= command in the Win.ini. I did that. I found though that when I clicked on the Ptsnoop.exe file with my cursor that the monitor freaked out and when I hit the space bar, the monitor corrected itself. Then, I discovered that merely entering the Windows folder using My Computer freaked the monitor out. I had to delete Ptsnoop by going to DOS Mode and typing at the prompt the following:
'cd \windows'. Then I typed 'del ptsnoop.exe' and pressed enter. No problems since.

Okay, here is the scoop. Ptsnoop.exe is a program which checks com ports on PcTel Modems. The latest anti-virus definition of Norton Anti-virus 5-10-2000 mistakes it for a trojan virus because ptsnoop.exe is written just like a trojan virus. If Norton's virus scan mode is on while installing modem software or if ptsnoop.exe turns on while norton is scanning, Norton will quarantine Ptsnoop.exe and take it out of the Windows folder. The callout LOAD=ptsnoop.exe in the Win.ini can't find the file anymore and an error message comes on about it when you boot into Windows. Until Symantec does something about the mixup if they even can do anything about it, the callout in the Win.ini has to be taken out and the modem has to run without Ptsnoop.exe. So if Norton hasn't quarantined it, you can exit to DOS Mode, change DIR at the C Prompt to the Windows Directory and Delete Ptsnoop.exe.

Ptsnoop.exe is not a PWSteal Trojan Virus. It is a poorly written program by PcTel which the latest Anti-virus software interprets as a virus. You can disable Ptsnoop.exe with no problems.

I recently upgraded to a generic modem (56k HSP) and I found this file running. I removed it immediatly. But i didnt delete it I left it there and it was no longer running. I then upgraded my NAV2000 and it told me that it was an AOLPWStealer. But I hexed it(im a computer pogrammer) and it is NOT an AOL Password Stealer BUT it maybe ne somthing that opens a door aka Port up on your computer. The reason NAV alerts you to this as a PWS is because it contains the line of code: Win.ini and NAV scans for this. But my point is why would a company name a file SNOOP? Unless pertaining to Snoopy the dog??? Something is def not right with this... I Mean call it ModemDrver or something! I totally plan on E-Mailing PCTel about this file! And i suggest eeryone else does the same this is not right! Hiding a file in my PC called PTSnoop! Oh and by the way my PC runs fine now that I removed this file, before the modem couldnt keep a connection! I guess this is what i get for buying generic! To remove this file: Press Crtl+Alt+Del click PTSNOOP and press End Task do this till its gone. Then goto Start Menu then Run Then type in Win.ini When that loads up look at the line Load= it will say Load=PTSNOOP.exe just erase that line and then save it... Reboot and it should be gone.

I also had PTSnoop.exe come up as a virus yesterday. Why I do not know... PTSnoop has been in my system forever.. why all of a sudden its showing as a virus is beyond me.. Also.. this PC I am on has no modem at all. Go figure :/

I just got this trojan warning from NAV today as well!! I'm not going to freak out too much, and write it off to a bad virus definition update. I've heard of people scanning their original cd, and that file is supposedly infected. Hmmm..... I'm going to try that when I get home to eliminate any doubt. The ptsnoop.exe doesn't appear to try to communicate with the outside world through my firewall yet.....

PTSNOOP.EXE CONTAINS PWSTEAL.TROJAN.B VIRUS (AKA AOL PASSWORD VIRUS)!!!
This is a report that I received directly from Norton Antivirus after our NAV software detected a virus in PTSNOOP.exe - We had just updated the virus definitions in our build of Norton Antivirus when it detected the virus.
We have analyzed your submission. The following is a report of our
findings for each file you have submitted:filename: C:\WINDOWS\PTSNOOP.exe
machine: ********** (changed by post for security reasons)
result: This file is infected with PWSteal.TrojanThe current monthly definitions are capable of detecting and repairing
this virus. Please update your definitions by clicking the "LiveUpdate"
button in your NAV program.Developer notes:
C:\WINDOWS\PTSNOOP.exe is infected by a non-repairable virus or a Trojan Horse. You should delete this file and replace it if neccessary.
Should you have any questions about your submission, please contact
technical support at the appropriate number listed below and give them
the tracking number in the subject of this message.-----------------------------------------------------------------------
This message was generated by SARC automation.

I have had exactly the same problem as described by many people here on my laptop computer which is very rarely used to access the internet ... the only sites I visit with it is Microsoft for software updates and Norton for virus updates.
I haven't loaded any programs from magazine covers onto it as I use it solely as a development tool. I also can't recall using a floppy disk from anyone (but am not ruling that possibility out completely). I can't believe it is a virus.
Norton only detected it upon the first reboot after getting their latest virus definitions ... I am inclined to believe it is a Norton cock up.

FROM THE f---ING GOOFS AT SYMANTEC!!!
Norton AntiVirus falsely detects the PWSteal.Trojan after updating virus definitions to May 8, 2000, or later
Situation:
After updating virus definitions to May 8, 2000, or later, Norton AntiVirus detects the PWSteal.Trojan in the Ptsnoop.exe file.Solution:
This was a false detection, also known as a false positive. A false positive occurs when an antivirus program reports a virus in a file that is not actually infected.The Symantec AntiVirus Research Center (SARC) is aware of this false detection, and has released new definitions to correct the problem. Updated virus definitions are available through LiveUpdate and the Virus Definition Update Installer.
If you have questions about how to run LiveUpdate, please see the document How to Run LiveUpdate.
If you have questions about updating your virus definitions with the Virus Definition Update Installer, please see the document How to update virus definition files using the Virus Definition Update Installer.

I don't think they have sorted it - I only updated my virus definitions yesterday; Norton still picked it up.

I had the same exact thing happen, everytime i'd load up my browser window and connect the screen would freeze up, did ctrl+alt+del and found this thing called PTSNOOP and was like . what the hell is this? i thought at first it might be some kind of Trojan, virus scan didn't pick it up, i 'm not sure whether to delete it or not but I will tell you this, my connection is stable now that I have closed the program, so whatever it is, it is just plain no good!

I have that program loaded on my computer, and I just received my phone bill with $238 worth of calls made to some other countries. I have not made those call. Later, I found out there was a program called SEXCALL located on my HDD. I wonder is it possible for someone to use that program to dial some long distance number when I am not aware of it. Please anybody respond if you have similar issue or any ideas.
Thanks.

Ptsnoop gave me no problem on my amd 550 k7 athlon using windows 98 se plus 2nd release.
But when I installed voicemail software, windows would crash during message play back.
Ptsnoop was the culprit. So I removed pointers to it without deleting ptsnoop itself.
1. go to win.ini
find load= and run= and delete ptsnoop from infront of the.my modem and voicemail work fine with no sideeffects yet noted.

I have deleted the PTSNOOP.exe from my hard drive. There is no reference to it in win.ini or config.sys or autoexec for that matter. When I run msconfig it listed it in as a start up item . I unchecked the box and edited my registry toremove it from the run key. When I rebooted my computer it replaced the key in my registry and created a second line in my msconfig start listing and rechecked the box to run the program . Even though I deleted it from my hard drive It still bugs me that I cant remove it from my registry or my msconfig start up. Does anyone have the answer to how to get rid of this thing? It is terribly annoying..
XOK

I have deleted the PTSNOOP.exe from my hard drive. There is no reference to it in win.ini or config.sys or autoexec for that matter. When I run msconfig it listed it in as a start up item . I unchecked the box and edited my registry toremove it from the run key. When I rebooted my computer it replaced the key in my registry and created a second line in my msconfig start listing and rechecked the box to run the program . Even though I deleted it from my hard drive It still bugs me that I cant remove it from my registry or my msconfig start up. Does anyone have the answer to how to get rid of this thing? It is terribly annoying..
XOK

I installed a new modem on a networked pc I have in the basement. I have ICS installed and that pc, through the network, dials out on my main pc. I use an external modem on the main pc. I found whenever the pc in the basement was turned on, the modem on the main pc would try to dial out before I'd shut if off. In tracking down what was dialing out, I found it to be PTSnoop.exe. I rename the executable c:\windows\ptsnoop.exe and removed the line from the win.ini since doing that the main pc modem no longer tries to dial out when the pc in the basement is turned on. If it isn't a trojan, why is attempting to connected to the internet when no internet software is being initiated?? I believe it is attempting to pass information out.

Oh my gosh the world is ending! I have ptsnoop too! And what a coincidence, I also have an HSP modem. WOW! I believe it's some sort of program that infects your hard drive and eventually will blow up and destroy every electronic device within 25 miles. Come on people! Let's get some sanity here. Ptsnoop.exe is a program that monitors your com ports for HSP modems. It is extremely resource hungry and will slow everything down. If you want you can try to get rid of it by deleting it and it's references. Either your modem will work still, or it won't, in which case you would put it back.
By the way, Microshaft Winblows has more ways than one to boot thing up behind your back. Check the following: Windows registry, win.ini, system.ini, config.sys, autoexec.bat, winstart.bat, and the famous startup folder, not to mention any scheduled tasks. Regrun II does a good job of catching these. Now have we learned our lesson? Never ever buy an HSP modem, or windows for that matter.

If ptsnoop.exe is harmless can any body explian to me why Lockdown Ver 7.0 picks it up as a Trojan?.It is also in the trojan list on this version of Lockdown

When pressing Ctrl+Alt+Delete, you see that PTSNOOP is running on your system.
Solution: To resolve this:
1. Click Start and choose Run.
2. Type SYSEDIT and click OK. The System Configuration. Editor opens.
3. Click the WIN.INI title bar.
4. In the LOAD= line, you will see PTSNOOP.exe. Place a semi-colon in front of this line. For example: ;LOAD=PTSNOOP.exe
5. If there are other items in the LOAD= line, place them on a new LOAD= line directly below the original.
For example: ;LOAD=PTSNOOP.exe
LOAD=LOAD=line>
6. Choose File, Save, then File, Exit.
7. Restart the computer.NOTE:
PTSNOOP is a token program that waits for a program to request the COM port to be opened. Then it makes sure that the modem drivers
get loaded if they are not.
PTSNOOP can be found with several different modems, such as the MICOM HSP PCTEL and EPS Technology COMM WAVE PCMCIA modems. It is not mandatory for proper operation, and the
manufacturers list removal of PTSNOOP in various steps of their troubleshooting procedures.

I found this thing because my browser started to fail a lot. one day, the navigator just froze and i pressed crtl-atl-supr and i saw that ptsnoop thing... the next day i told my brother about it and we crt-alt-supremed and while we were watching that and wondering what that was, the computer was shut down by someone else...

Got a new hitch for you! I just installed a NEW HSP modem and was having shutdown BLUE SCREEN OF DEATH problems. Found this web site, went looking for PTSNOOP in the win.ini file. IT'S NOT IN THE WIN.INI FILE ANYMORE. THE BAS..... PUT IT IN THE REGISTRY. Run regedit, go to edit, find, type PTSNOOP, enter. When found HIT THE DELETE KEY! Keep searching until you don't find another one. Remove the .exe.

pt"snoop".exe eh? VERY interesting.... i have had two networks (tied together over i-net) up and running for over 2 years, and in the last month, i would be woke up in the middle of the night when my server would "access" the a:\ drive for no reason. anticipating that it was an attack from i-net, i disconnected the phone line and the same thing happend the next night. after investigation, i noticed this "ptsnoop.exe" in my running tasks. after removing it from win.ini AND registry, the "accessing" quit. what exactly is this program? it buried itself on various computers on my LAN. and why is it here for the "modem" if the company admits in their "troubleshooting" to remove it? i beleive there is more than what meets they eye here. removing the program has changed nothing on my computer other than i access my browser faster and my monitor doesnt pop up pretty little colored blocks all over the place periodacally now.

I have found the ptsnoop.exe on my system also. Appears this virus creator was very smart to make the name the same as a legitimate component based on the loads of confusion published here. However, if you look at the version information on the file, it says it is a Microsoft Office component and then says copyright Microsoft Corporation, but there is no (c) date like usual. Upon inspection of the binary, it looks to me like it might not be a password stealing program, but might be used to simulate clicking on banner ads on websites. Perhaps someone has signed up for a bunch of click-thru programs and is using these little ptsnoops to make some money by getting lots of click dollars. I could be wrong of course, and maybe it was trying to steal all my passwords, but it's gone now.

I also deleted PTsnoop seems like the cool thing to do hah hah
i got a program recently called "Xteq x-setup" amazing program i recoomend it to everyone i found out i had 3 other trojans that i had no clue i had!

There are PLENTY of programs in the
world that are picked up as trojans by
antivirus software, even when harmless.
Why?
Because some programs perform what a
virus-scanner would call virus-like activity.
Virus scanners don't just search for
known viruses, they're designed to go
after ones that aren't out yet, it's what is
known as heuristic scanning. Because
PTSNOOP.EXE monitors serial ports, and
stays memory resident in background,
this raises a red flag with several virus
scanning programs. I'm not saying
whether the file is well coded or not, just
that it's not a trojan. I've been a computer
technician for 6 years now, and I've seen
this with other files too.

![]() |
![]() |
![]() |

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |