Is "NPFMONTR.exe" good or bad?

[Pikachu]

Hello everybody!

I can't seem to find any information on the net regarding NPFMONTR.exe. I realized its existance when I was looking in my Program Controls (FIY, I'm using ZoneAlarm Pro) This "thingy" is located in Windows\System32 folder. Does anyone know if this "thingy" poses a danger or not?

Thanks in advance!

;)

[dlh6213]

Hi Pikachu,

What little I could find out about it doesn't really help much (http://translate.google.com/translate?hl=en&sl=zh-CN&u=http://bbs.db.kingsoft.com/forumdisplay.php%3Ffid%3D110%26sid%3Dnbdq4L&prev=/search%3Fq%3DNPFMONTR.exe%26hl%3Den%26lr%3D%26sa%3DG).

Lack of information is usually a pretty good indiction of a bad file. Can you right-click on NPFMONTR.exe, go to Properties, and let us know whatever info you can (Manufacturer, version, etc.).

[jmolpda]

npfmontr.exe is bad, bad.
I have a Sonicwall firewall (TZ170) that goes to 6200 sessions in 1 minute when this program is running. npfmontr was slowing down all the internet connections.
The mistery here is how this programa gets into the startup programs in my web server !!
The solution was simple, just take out npfmontr.exe from the startup programs (I had to download a msconfig program for windows 2000 server).

The problem happens on Jun-02 the same date that npfmontr.exe file has.

Hope this help.

[gridbox]

Hey folks. NPFMONTR.exe is very bad.
I have ca Associates anti-virus and firewall. The Firewall kept prompting me if NPFMONTR.exe should be allowed to access the internet. That's when I found this volley of correspondence - the only one on the web! (in English) Thanks!
Wanted to pass on to those interested that just now, the anti-virus snagged NPFMONTR.exe and associated it as part of the Win32.Rbot family.
Here's ca's link covering the Win32.Rbot info: http://www3.ca.com/securityadvisor/virusinfo/search.aspx?mode=tmc&pst=Win32.Rbot&allwords=false&nameonly=false&cat=0&type=0
Delete it!

[Pikachu]

Thanks guys! But I found out the hard way.
It came along with svhosts.exe (note the 's' at the end before the .exe) which I quote from www.processlibrary.com

svchosts.exe is a process which is registered as the Troj/Sdbot-N Trojan. This Trojan allows attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately.

But finally managed to get rid of it. Thanks anyway!

Cheers!

[buddylee614]

- those virus and adware makers are finally getting smart, i dont think i could have seen that 's' at the end i would have past it of as svchost.exe..

thanks for the info.

buddylee614, viz ex
happy web browsing :mrgreen: