What the heck is the APCTLSP

[PvtMatter]

I have a file on my desktop and in my documents folder that reappears every time I cancel it. It is a text file.

Here is the file:
00001348 00004728 03/18/10:06:29:12:026,8 DllMain Called: 1

00001348 00004728 03/18/10:06:29:12:027,5 PCTLsp.dll: DLL_PROCESS_ATTACH (0)
00001348 00004728 03/18/10:06:29:12:027,5 Program: <qw.exe>
00001348 00004728 03/18/10:06:29:12:028,2 WSPStartup IN PCTOOLS over [MSAFD Tcpip [UDP/IP]]
00001348 00004728 03/18/10:06:29:12:029,5 PRE WSPStartup: 0, stopCapture:0
00001348 00004728 03/18/10:06:29:12:029,5 WSPStartup Calling INI_InitModules
00001348 00004728 03/18/10:06:29:12:030,2 INI_InitModules: Start
00001348 00004728 03/18/10:06:29:12:031,0 Create SECURITY_DESCRIPTOR, os =6

00001348 00004728 03/18/10:06:29:12:032,5 INI_InitModules: globalName=1, secAttr=1
00001348 00004728 03/18/10:06:29:12:033,5 INI_InitSharedMem: Open Global\PCTLspSettings
00001348 00004728 03/18/10:06:29:12:033,5 INI_InitSharedMem:Open Setting Share memory (00000430)183
00001348 00004728 03/18/10:06:29:12:034,5 INI_InitSharedMem:CreateFileMapping
00001348 00004728 03/18/10:06:29:12:035,5 INI_InitSharedMem: MapViewOfFile
00001348 00004728 03/18/10:06:29:12:036,5 INI_InitSharedMem: End
00001348 00004728 03/18/10:06:29:12:036,5 INI_InitModules: shareMem OK
00001348 00004728 03/18/10:06:29:12:037,5 INI_InitModules: LSHHASH_Init OK
00001348 00004728 03/18/10:06:29:12:037,5 INI_InitModules: PCTHOOK_Init OK
00001348 00004728 03/18/10:06:29:12:038,2 CFS_Init: iInited=0,ref=0, iCommponentInit=0,active=0
00001348 00004728 03/18/10:06:29:12:039,5 INI_InitModules: CFS_Init (0)
00001348 00004728 03/18/10:06:29:12:045,5 Layered over 3 protocols
00001348 00004728 03/18/10:06:29:12:046,5 Layer is PCTOOLS over [MSAFD Tcpip [TCP/IP]]
00001348 00004728 03/18/10:06:29:12:046,5 Layer is PCTOOLS over [MSAFD Tcpip [UDP/IP]]
00001348 00004728 03/18/10:06:29:12:047,5 Layer is PCTOOLS over [MSAFD Tcpip [RAW/IP]]
00001348 00004728 03/18/10:06:29:12:048,5 LoadLibrary on: C:\Windows\system32\mswsock.dll
00001348 00004728 03/18/10:06:29:12:049,5 NextProcTable.WSPStartup = 0x737B9125 [MSAFD Tcpip [TCP/IP]]
00001348 00004728 03/18/10:06:29:12:050,5 LoadLibrary on: C:\Windows\system32\mswsock.dll
00001348 00004728 03/18/10:06:29:12:050,5 NextProcTable.WSPStartup = 0x737B9125 [MSAFD Tcpip [UDP/IP]]
00001348 00004728 03/18/10:06:29:12:051,5 LoadLibrary on: C:\Windows\system32\mswsock.dll
00001348 00004728 03/18/10:06:29:12:051,5 NextProcTable.WSPStartup = 0x737B9125 [MSAFD Tcpip [RAW/IP]]

Any idea which program is installing this file? How do I prevent its reappearing?

 

[Bill2]

Hello,
This seems to be a PC Tools bug. The file pctlsp.dll is installed by PC Tools Antivirus (free version) in the directory C:\Program Files\Common File\PC Tools\LSP.

 

[karlsnooks]

PvtMatter,
Download Malware Bytes Antimalware from MalwareBytes.ORG Malwarebytes.org

and definitely not from MalwareBytes.com

Download Microsoft Security Essentials http://www.microsoft.com/security_essentials/

Disable and remove your current Antivirus software.

Install and Run MalwareBytes antimalware (a quick scan will probably suffice).
Let MalwareBytes antimalware remove any bad guys.

Install and run Microsoft Security Essentials.

You're computer is now safe and sound.

 

[thathagat]

1. as pointed earlier its related to pctools.
2.its not malicious....
pctlsp.dll | ThreatExpert statistics
PCTLsp.dll - What is PCTLsp.dll? - PC Tools Layered Service Provider
3.if you are using pctools av then read this...
Please confirm. "all versions" does not include the free version? - PC Tools Community Forum

End of support for PC Tools AntiVirus™


From the 8 March 2010, PC Tools will begin phasing out support for all versions of PC Tools AntiVirus. PC Tools AntiVirus will no longer be available for purchase or renewal, and if you’re registered for the Automatic Renewal Service we will not renew your subscription. We will continue to support existing customers with signature updates and customer support until end of March 2011.

 

[PvtMatter]

Thank God I have another computer and can access this forum after my "changes & fixes" were applied.

Thanks guys for all the suggestions. Here is the complete story:

I originally installed PC Tools Antivirus because MS Essentials would not install. I ran the uninstall program but the program was still shown in C:\Program Filesx86\common files. I could not delete the LSP file since it said the program was in use (I had rebooted after the uninstall). I downloaded Malwarebytes from the .org location, ran the complete scan and had no infections. I found a couple of items in the Registry relating to PC Tools and uninstalled them. After I uninstalled PC Tools antivirus, I downloaded AVD free and installed it. Ran the full version of registry booster and all errors were fixed.
Later, I re downloaded MS Essentials and attempted an install. Received message, "Can't complete installation, error ox80070643."
Deleted AVG program and restarted computer. Lost ability to connect to internet. Ran troubleshooting on that program but could not connect so that's where I am....no internet, no antivirus programs installed (at least that I can detect) Registry booster uninstalled but Malwarebytes still installed.

I would add, I ran a virus scan with AVG and no viruses were detected.

I hesitated to do a system restore because I didn't want to undo the "good things" I had done, only the bad thing (lost the internet). But I did do a system restore. But no internet. Tried different restore points.... still have no internet but when I run troubleshooting it says I am connected! Go figure.

Tried restoring Windows from Previously created system image. It worked..have internet but still cannot delete in C:\ProgramFiles\common\PC tools.

So in summation I want MS Essentials to install. But apparently, I need to get the open PC tools off my computer IF that is what keeps MS Essentials from loading. Please help.

 

[thathagat]

hi.....read here it might help you...
PC Tools antivirus..cant delete it? - PC Tools Community Forum

and

PC Tools Community Forum - View Single Post - SOLUTION: No Internet after Uninstalling PC Tools

 

[PvtMatter]

Thanks Thathargat..tried those...didn't work. Still have one .dll file, PCTLsp.Dll that I can't delete. I guess that is what is showing Windows Security Essentials that I still have an antivirus program open.

 

[karlsnooks]

PvtMatter,
If you boot into SafeMode using an administrator account, can you delete the file?
If not, go to a command prompt, go to where that file is located and try to delete it. If you can't then use the ATTRIB command to view its attributes, then once again use the ATTRIB command to remove any system, hidden, read-only attributes and delete the file.
If you are not familiar with the ATTRIB command then ATTRIB /?

If your efforts here fail, then download, run and install autoruns.exe Run Auroruns as administrator and go searching for anything related to your antivirus program and uncheck any of them that you find. close program and reboot.

Autoruns for Windows

 

[PvtMatter]

Thanks Karlsnooks. Here's what happens when I tried your suggestions.

1. Could not delete the file in Safe mode.
2. Tried the CMD approach...nothing
3. Downloaded Autoruns. Found PC ToolsKDS core driver. Deleted it. Had 4 other PC Tools entries....PC Layered Services. Could not delete them ...said they were tied to a Winsock. All I could do was disable them. When I did the items in step 3, my computer would not restart. Did repair and restore and now I am back to square 1.

PC tools is running and I can't figure a way to kill the D@#$ program.

 

[karlsnooks]

PvtMatter,
Go back into Autoruns and only Disable. Do not delete.
If after a shutdown and reboot, you then find some of the deletions again, then your anti-virus program is a nasty piece of malware. Contact the AV company and ask what procedure to follow. If none of these work, then I'm out of ideas.

 

[Jacee]

I originally installed PC Tools Antivirus because MS Essentials would not install

MS Essentials will only install if you're running a 'legitimate' copy of Windows.You may have to verify your copy of Win7
Genuine Microsoft Software
Click on "Validate Windows" (left hand side)

 

[thathagat]

try revo
Revo Uninstaller - Reviews and free Revo Uninstaller downloads at Download.com

 

[PvtMatter]

PvtMatter,
Go back into Autoruns and only Disable. Do not delete.
If after a shutdown and reboot, you then find some of the deletions again, then your anti-virus program is a nasty piece of malware. Contact the AV company and ask what procedure to follow. If none of these work, then I'm out of ideas.

Thanks. I will follow your instructions. If others would keep suggesting things to try, I would appreciate it. Tried Unblocker 1.8.9 but there are no instructions...it just autoruns but I don't know what to do with it since the program does not open to a screen.

 

[PvtMatter]

PvtMatter,
Go back into Autoruns and only Disable. Do not delete.
If after a shutdown and reboot, you then find some of the deletions again, then your anti-virus program is a nasty piece of malware. Contact the AV company and ask what procedure to follow. If none of these work, then I'm out of ideas.

Karl I did as you suggested...disabled PCT core but could not disable other 4 PC Tools items, PC Tools Layered Support so I left them alone. When I rebooted...computer would not start...had to do a recovery. Back to the beginning now.....guess AVG support might have a clue as to how I will delete PC Tools.......If I can get support.

 

[PvtMatter]

Thanks all...problem solved...please close thread.