Suspicious activity monitoring cpqset and qttask

Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Sed posuere consectetur est at lobortis. Vestibulum id ligula porta felis euismod semper. Donec ullamcorper nulla non metus auctor fringilla. Aenean lacinia bibendum nulla sed consectetur. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Cras mattis consectetur purus sit amet fermentum. Morbi leo risus, porta ac consectetur ac, vestibulum at eros. Sed posuere consectetur est at lobortis. Etiam porta sem malesuada magna mollis euismod. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Aenean eu leo quam. Pellentesque ornare sem lacinia quam venenatis vestibulum. Curabitur blandit tempus porttitor. Sed posuere consectetur est at lobortis.

Hi All

I keep finding these two making changes on my start up settings.The recent changes have been qttask made 38 changes,and cpqset has made 34 changes.when I first noticed this they were only making 6 and 7 and the number has gone up to this???I know cpqset is H/P and qttask has to do with quicktime.Norton says the risk is low but why are they doing this?I have  a compaq laptop Xp home SP3,

the QuickTime I think came with my camera software.Any suggestions,Is this normal and should I change something to stop it.

Thanks Mo

qttask I think has to do with apple and Itunes stuff

Hi mo and NY1986,

 

Mo you are correct that cpqset is an HP item. The cpqset.exe process is for the user to change various settings regarding the configuration of your Hewlett Packard computer.

 

qttask is part of QuickTime and the only thing it does is to place the QuickTime icon in the system tray by the clock. If you check your task manager you will find that qttask does use a small amount of memory. If you want to disable this feature you can follow this procedure:

 

Go to My Computer > Local Disk C > Program Files > QuickTime.  Double click on QuickTime to open it. Look for qttask and rename it to qttaskold.  Then go to msconfig and uncheck qttask in the startup list. Perform a restart. You will no longer have the icon in your system tray; if you want the icon back just change the name back to qttask and the icon will return.

 

Disabling qttask will not prevent you from using QuickTime; I have it disabled.

 

If for any reason qttask is located anywhere other than the above location, it could be malware. To double check that it is not malware, do a search of your computer to be sure qttask is located only under QuickTime.

Message Edited by Phil_D on 09-22-2008 09:53 AM

If you open quicktime and go to preferences, you can disable the load at startup option.  Much simpler and it remembers the setting when you upgrade the quicktime program.  You can remove the registry entry in the "run" section if you never want to hear about it too, but the disable at startup option should do the same thing.

 

Hi Phil,

 

I've tried that option in preferences and it has not worked for me. As soon as I reopen QuickTime, the icon appears again.

 

Rather than go into the registry, I have found that simply renaming qttask does the trick for me.  And it's easily reversible if the user changes their mind.

 

But mo and NY1986 can try both options and see which works for them.

Message Edited by Phil_D on 09-22-2008 10:27 AM

Hi

 

"cpqset" belongs to HP configuation tool. It comes with HP laptops / Notebooks.

 

It is not need to run on startup, use "Msconfig" and untick it, the restart your PC. 

 

 

Quads 

Good tip from Quads!

 

So many unnecessary programs by default want to run at startup, they can really start to clog up your system.

 

I only have three (necessary) items checked in msconfig startup.

Hi

 

Yeah,  Like Quicktime which I got around along time ago, I use Quicktime Alternative , Most people notice MSN messenger after start-up even though they done use it at all.

 

 

Quads 

Hi all/Phil_D

Thanks for your great response,Phil_D can you explain the "msconfig" part Of how to go about it.I have only recently done a scan in safe mode and that was nerve racking so a detailed/step by step of how to do it would be great.and if I'm not asking to much what msconfig actually is on the computer.And qttask only comes up under quicktime.Can this be why its so slow at start up?

Message Edited by mo on 09-23-2008 09:21 AM

Hi again

 Norton in advanced details gives you the option of removing this program.So I am assuming this is not the correct way to deal with this issue?

Thanks again Mo

Hi mo,

 

I think the best suggestion would be to follow Quads advice to uncheck cpqset in msconfig, and then either my option or Phil's option to stop qttask.

 

To get into msconfig:  Go to Start > Run and then type   msconfig   in the "Open:" box, then click OK.

 

A new window will open. Select the "Startup" tab.  Scroll down until you find  cpqset  and uncheck it. Click Apply, Okay and then you will be prompted for a restart.  Once the restart is complete,  a window appears confirming that "The System Configuration Utility appears that you have made changes to Configuration". Check the box that says don't notify me again and click Okay.

 

Here is a link with some images if that helps - be sure to select your operating system from the choices.

Message Edited by Phil_D on 09-22-2008 10:44 PM

Hi Mo

 

Use the Msconfig and untick both (cpqset & qttask), that way is safer as you can always tick it again so that it will run at start-up at a later date if you wish.

 

 

bye

 

Quads 

1 Like

Here's what the 2 entries look like in Msconfig /   Startup tab

 

 

cpqset

 

qttask

 

 

bye Quads 

Hi All

I Went and did what was suggested thru the msconfig I unchecked both qttask/cpqset.A piece of cake thanks for your easy to follow instructions.Can I run this by you all I found these on start up as well are they necessary????

-msmsgs"C:\program files\ mes       which I assume is messenger which I don't use and haven't turned on  instead of HKLM\software\Microsoft it says HKCU\software\Microsoft is that normal?

-ctfmon C:\windows\system HKCU\software\Microsoft just checking this one as this is the file that is blocked because Norton picks it up as a keylogger.

The other ones are to do with my camera software monitor and first start ,do these need to be on start up and if I unchecked them would it upset the functionality of the camera program?

And hopefully the last queston why are some HKCU(3) and the rest HKLM which are mainly Norton,H\P,Microsoft

A big thanks to you guys for your help and teaching skills

Cheers Mo:smileyvery-happy:

 

              

Hey Kiwi Mo

 

"msmsgs" is indeed MSN messenger, you can untick this. You may find more than one entry   including one with "/background" on the end.

 

"ctfmon"  the legitimate file is "ctfmon.exe" listed wityh file location 

 

  

 

and 15.0 kb in size. Is part of Microsoft Office XP, it monitors for Speech recognition etc. 

 

You typed "ctfmon C:\windows\system" just making sure it's not a typo    system not system32??    if indeed it is in the system folder not the system32 folder it's BAD.

 For one "Family Keylogger" uses  "C:\windows\system\ctfmon".  and "ctfmon.dll"  More info as possible for this one.

 

Now  the camera software, I would think not, but I have no definatave answer as sometimes if you stop a device driver on start up you can't load it after.  You could untick to find out. if you have a problem from doing that, just re-tick it and restart the PC.

 

HKCU full length, HKEY_CURRENT_USER stores settings that are specific to the user currently logged on.

HKLM full length, HKEY_LOCAL_MACHINE stores all settings that are for all users on the computer. That is why you will see Norton, drivers etc here.

 

Cheers

 

Quads 

 

 

Hi Cuz(Quads):smileywink:

I will check the ctfmon I'm sure it was just system!So I will get back to you,Thanks for the other info,any thing else I should look out for while I'm in there??

Cheers Mo

Mo

 

One thing you could do is search to see how many "ctfmon.exe" 's are on your system, and where it/they are.

 

Quads 

 

 

Mo 

 

I will PM (private messaged) you in a moment

 

 

Quads 

 

 

Hi Quads

unchecked messenger but not the others as I would not be confident to fix anything if I stuffed up.Now I looked at ctfmon its in C:\WINDOWS\system... (that's exactly how its shown on the screen)I usually can hover the pointer over it and the full description comes up but it does not work in msconfig and I don't know enough to bring up the full description confidently.there is another thing that's there and that is carpserv.exe no program file just carpserv.exe under the command line???

Thanks for your  help

Mo