Spoof Ebay email and ctfmon.exe

['Shy]

Hi folks. I received a spoof email today claiming to be from a potential buyer. I didn't realise it was spoof at first and clicked on the link it had put to view the item, thought it was odd it asked me to log in just to view an item so closed the browser again (Firefox, if you're interested), didn't enter any details of course. Looked at it more closely and a few things were wrong - for a start it had sent it to an email address that is not registered with Ebay (actually this is interesting, it was sent to my catch-all domain email as david@tru-books.co.uk and I assure you I'm not a David, female for a start! - which does not appear on any of my Ebay auctions, but the website address does appear in my "about me" page, but I digress...), and the auction end date was dated May 2006. Anyways, so I forwarded it to spoof@ebay.co.uk

I decided to run Norton to be on the safe side and as I opened the internet security bit, I got a firewall popup telling me ctfmon.exe was trying to access, and in my haste (cos I was annoyed I got a popup) I just clicked allow. Then, in hindsight I decided to Google the file. It has mixed reactions on a forum I read - some think it's a trojan, some think it's a keylogger, and some think it's harmless to do with the language bar.

I wondered if anyone had any personal experience with this particular file. The Norton scan came back clear, I wonder if it was just a coincidence. But I did (up until a couple of weeks ago) play World of Warcraft, and I know there are keylogger scares going on in the community so now am paranoid and haven't dared go anywhere since. The last thing I need is my Ebay account hacked after all the hard work I've put in setting up my bookshop!

Thanks in advance for any replies or insight.

 

[Will]

Clicky.

 

['Shy]

Yeah, I read something similar, but I think that in conclusion, as long as it's in the Windows\System32 folder it's ok? And it was just a coincidence and my paranoia got the better of me?

 

[Debaser]

Coincidence & paranoia, aye.

You can easily disable the legitimate ctfmon service though, and you shouldn't miss it.

Controlpanel>Regional & language options>Languages>Details>Advanced <--- tick the 'turn off advanced text services' square.

... and ctfmon.exe should disappear after a reboot.

Process explorer is a good little app from Sysinternals for checking out what services are running and from where, http://www.sysinternals.com/Utilities/ProcessExplorer.html

 

[TdC]

tbh Shy, I'd run your fave anti-add and anti-spy software against your pc just to be sure.

 

[SAS]

Scan your system with:

Adaware: http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10045910.html
and
Spybot: http://www.safer-networking.org/en/mirrors/index.html

and a scan from your anti virus scanner