ntsrv.exe - how to remove? *SOLVED*

[dragonic]

So how to remove it? Norton doesn't pick it up so how can I remove it?

EDIT: Problem solved. Thanks for everyone who helped me

 

[John]

A good way to start would be to run both of these online scanners

Panda

Trend Micro

 

[Coquito]

I would also recommend bazooka.

 

[dragonic]

Well, I run the Trend Micro scanner and it found Backdoor.IzRam.1.7 in one file..I deleted the file and that was that but still, ntsrv.exe is still there...
oh, and bazooka told me the computer is clean

 

[SagaLore]

It is a trojanized ftp server. Why don't you just end-task it if it's running, and then delete the file?

 

[John]

Originally posted by: dragonic
Well, I run the Trend Micro scanner and it found Backdoor.IzRam.1.7 in one file..I deleted the file and that was that but still, ntsrv.exe is still there...
oh, and bazooka told me the computer is clean

Be sure to disable the system restore if you have Win ME/XP!

Run Panda.

 

[dragonic]

SagaLore: 'cause there aren't any ntsrv.exe files on my computer...at least I can't find one..
John: Panda showed that the system was clean too...

 

[SagaLore]

Originally posted by: dragonic
SagaLore: 'cause there aren't any ntsrv.exe files on my computer...at least I can't find one..
John: Panda showed that the system was clean too...

How can you remove something that isn't there?

 

[dragonic]

Originally posted by: SagaLore

Originally posted by: dragonic
SagaLore: 'cause there aren't any ntsrv.exe files on my computer...at least I can't find one..
John: Panda showed that the system was clean too...

How can you remove something that isn't there?

well they were on task manager but now after using the computer for a while and restarting they're gone
oh well, gotta be happy that those are gone
but now my windows update won't work...I see it on my taskbar but it won't show up :| What's wrong with it?

 

[SagaLore]

Originally posted by: dragonic
but now my windows update won't work...I see it on my taskbar but it won't show up :| What's wrong with it?

I've never found the windows update application to be reliable. Go to http://windowsupdate.microsoft.com and run your updates that way instead.

 

[dragonic]

Originally posted by: SagaLore

Originally posted by: dragonic
but now my windows update won't work...I see it on my taskbar but it won't show up :| What's wrong with it?

I've never found the windows update application to be reliable. Go to http://windowsupdate.microsoft.com and run your updates that way instead.

Yeah, I'll propably do so

 

[mechBgon]

Big picture:

1) what version of Norton do you have, hopefully one of the modern ones (2004 or 2005), since that appears to be your real-time protection here. If you want, you can grab a free 15-day trialware of Norton Antivirus 2005 from here. Run LiveUpdate repeatedly, rebooting as prompted, until it comes up happy, then tack on the daily Intelligent Update.

2) is Norton set to use maximum heuristics and to scan within compressed files on both the AutoProtect and the Manual Scan panels in Options; if not, change that.

3) patch your system with the latest Microsoft updates. Microsoft Baseline Security Analyzer is a good tool, it sees deeper than Windows Update does.

4) right-click My Computer > Manage > Users & Groups > Users, and give all the Admin-class accounts a strong password such as dragonic@AT to prevent a no-brainer appropriation of the Admin-class accounts' powers.

5) if you have a router, close the ports you don't need open. Ones you'd probably need open include 20 & 21, 25, 53, 80, 110, maybe 143, and 443. If the computer comes down with another remote-controlled Trojan but can't "call home" to get instructions because the router is blocking port ____ outbound (insert random port the Trojan wants to use), that's partial damage containment at least.

5) be more careful This stuff doesn't fall from the sky. Warez, pr0n, P2P and letting other people use your computer are all potential risk factors that are under your control. If others will be using your computer, make sure there's a Limited-class account without password protection for them to use, and protect the Admin-class accounts. Consider using Limited yourself, they're harder to exploit.

 

[dragonic]

1. Norton Internet Security 2005 with all the updates I can get through liveupdate
2. Yes, it is
3. System is patched with all the latest security updates
4. yeah, I propably should do so
5. Don't have router
6. I'll try to more careful I think I even know where I got this but since Norton cleared the file I thought it was safe which was a mistake but thankfully, it fixed now.