BleepingComputer.com: When Using Spybot, System Startups?

I would be delighted to know a little more about diagnostics in various areas of my PC, and at this time especially in the Startup list and have a couple of questions that concern the recommended path of analyzing these.

I presently am using Spybot tools and have reached the Startup list.

When using the BC Startup List, Many of my entrees have multiple answers as follows;

Located: HK_LM:Run, PHIME2002A
command: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
file: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
size: 455168
MD5: 024DC0F68DF5FD6AE9DD82DFBAF479D6
Name Filename Status Description
PHIME2002ASync dumprep.exe
X
Added by the W32/Puress-B worm. This infection should not be confused with the
legitimate C:\Windows\System32\dumprep.exe. ... Read More
PHIME2002A svchost.exe

X
Added by the W32/Puress-B worm. This infection should not be confused with the
legitimate C:\Windows\System32\svchost.exe. ... Read More
Phime2002a TINTSETP.EXE
N
Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese
text in IE, Outlook and Word ... Read More
PHIME2002ASync TINTSETP.EXE
N
Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese
text in IE, Outlook and Word ... Read More


How do I know which one of these pertains to the one I entered into the search, e.g. the one that I have in my PC ?


My guess is it would be the exact match,i.e., PHIME2002ASync, . . correct?

If so why all the others ?

This post has been edited by Jove: 20 September 2008 - 09:18 AM

Phime2002a or PHIME2002ASync ( TINTSETP.EXE)--Not Required at Startup - Application Launcher, Microsoft Office Application

dumprep.exe is a nasty
http://www.bleepingcomputer.com/startups/d....exe-23369.html

Garmanma,

Are you saying the one I have is a nasty ?

This is the one I have, . . .
Per Spybot :

Located: HK_LM:Run, PHIME2002A
command: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
file: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
size: 455168
MD5: 024DC0F68DF5FD6AE9DD82DFBAF479D6

This post has been edited by Jove: 20 September 2008 - 10:19 AM

Sorry, I did not do a good read on your post !

But thanks, so the one I have as previously stated is Sync and is not a nasty, Ok, its not required at start up, so if I uncheck it, will it start automatically when called upon ?

and if it does, will it revert back to the checked position in the utilities ?

Garmanma,
Let me ask you this, concerning the, BC Startup List Search, . .

For This:
Located: HK_LM:Run, IgfxTray
command: C:\WINDOWS\system32\igfxtray.exe
file: C:\WINDOWS\system32\igfxtray.exe
size: 143360
MD5: 3F2C31795D7D63BD002C2E0468636132
===========================================================
It found the following;

Name Filename Status Description
igfxtray igfxtray.exe
N
Quick access to the control panel via a System Tray icon for graphics based upon the
Intel chipsets (ie, i810). These chipsets are often included on m ... Read More

Name Filename Status Description

Intel® Common User Interface igfxtray.exe
N
Quick access to the control panel via a System Tray icon for graphics based upon the
Intel chipsets (ie, i810). These chipsets are often included on m ... Read More


As you can see the Original Entry; IgfxTray, uses upper case, and the search seems sensitive to upper case and often means an entirely different program, . . . .

So what do I have here ?

Using the startup database requires you to compare not only the filenames, but where they are located.

Dumprep.exe located in the C:\Windows\System32 is a valid file. If it is located elsewhere then it is likely malware.

Grinler,

Thanks for the reply.

Regarding ;
Located: HK_LM:Run, PHIME2002A
command: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
file: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
size: 455168
MD5: 024DC0F68DF5FD6AE9DD82DFBAF479D6
Name Filename Status Description
PHIME2002ASync dumprep.exe

I am trying to understand this and the information you referenced, therefore the following is my PC Information concerning the dumprep.exec, the location reference indicated here is, HK_LM:Run, PHIME2002A, I believe this to be a Registry reference, I believe you are referring to the file reference that will be found in my,
Local Disk (C:) and this I assume would be derived from the file reference ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE

I did find it the system32 file as in the following image

The only IME file I found so far is ime in the WINDOWS folder, . . I find no dumprep.exe file or reference there if the IME is a folder reference, if not what is it ?

I have noticed that the case, i.e. lower or upper seem to make a great deal of difference in the classification of files, and I would assume folders, unless this is otherwise and also is comparative information. Will case be pertinent in identifying files and folders?

Will I need to search each time to check each file as in this case. or am I reading the file location information incorrectly ?

Your command is located at:

C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE

The startup list has the same command listed as safe, therefore it is legitimate to be in that location. Upper and lower case really does not make a difference.

THe way to use the database is to check three things. If an entry has a name of PHIME2002A then you can search the database for that name. If it is found, you look at the command, which may not always be the same. Then look at the filename and its location. If the info in the startup database is the same info being shown in whatever you are using to view your startups, then you can safely assume what the startup database says is correct.

In this situation we have a legitimate startup database entry that has a name of PHIME2002A. That matches yours.

Your entry's start has the command line of C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName. That is the same as the one in the startup database. So that matches as well.

The path to the file is C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE. That is the same as your startup, so you can safely assume that your startup is legitimate.