Can you please help me I think I have problems with spyware?

Question

I have read that if you can find ctfmon.exe , spoolsv.exe , wmiprvse.exe and wuauclt.exe anywhere else in your computer except in C:\WINDOWS\system32 they might be spyware or virus.

Well,I found them in C:\WINDOWS\Prefetch and they look like this:

CTFMON.EXE-0E17969B.pf

SPOOLSV.EXE-282F76A7.pf

WMIPRVSE.EXE-28F301A9.pf

WUAUCLT.EXE-399A8E72.pf

Can you please tell me are they spyware and should I delete them or no?

By the way I have big problems with these in windows task manager (they keep opening all time).

I use Ad-Aware 2008

Answer 1

These are fine as they come from Microsoft Office and from the Operating system itself, so if you remove them not all of Offices or your OS components will work.  Add the Perfetch directory as OK like Win32. Your fine.

Oh, and if you want some information you can search for these by name. But all of the ones you listed came from MS themselves so these are ok. Lots of folks orignally thought these were spyware etc, but they aren't. You should find corresponding nmes with out the -xxxxx.pf in the win32 directory.  (Prefetch just loads them and they are needed.

http://www.edbott.com/weblog/archives/00... )

Answer 2

Hello Taxxx B. I would leave these program alone especially if you don't know what program need them as they might be a very important part for windows to work properly. The pop-ups that you mention is a form of Spyware/Malware so install this spyware program and run a scan right away. (http://www.superantispyware.com)  This spyware program get rid of and protects the computer from (spyware, malware, adware, trojan horses, and some computer worms)  So give it a try as I am sure that you will be happy that you did and it is Free. Now get srarted. Good Luck

Answer 3

As they are located in the Prefetch Folder this reduces the time that they take to load. If removed from Prefetch, the computer will take marginally longer to load the files.

WUAUCLT.EXE is Windows Update.

WMIPRVSE.EXE is a part of the Microsoft Windows Operating System and deals with WMI operations through the WinMgmt.exe process. This program is important for the stable and secure running of your computer and should not be terminated.

SPOOLSV.EXE is a Microsoft Windows system executable which handles the printing process.

CTFMON.EXE monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies.

None of these would appear to be a threat, but you can always carry out  a spyware scan with Malwarebytes Anti-Malware:

http://www.download.com/Malwarebytes-Ant...

Download, install, update and select Full Scan.

Remove all infections that it finds after scan.