• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

ntsrv.exe - how to remove? *SOLVED*

dragonic

Senior member
So how to remove it? Norton doesn't pick it up so how can I remove it?

EDIT: Problem solved. Thanks for everyone who helped me
 
Well, I run the Trend Micro scanner and it found Backdoor.IzRam.1.7 in one file..I deleted the file and that was that but still, ntsrv.exe is still there...
oh, and bazooka told me the computer is clean
 
It is a trojanized ftp server. Why don't you just end-task it if it's running, and then delete the file?
 
Originally posted by: dragonic
Well, I run the Trend Micro scanner and it found Backdoor.IzRam.1.7 in one file..I deleted the file and that was that but still, ntsrv.exe is still there...
oh, and bazooka told me the computer is clean

Be sure to disable the system restore if you have Win ME/XP!

Run Panda.

 
SagaLore: 'cause there aren't any ntsrv.exe files on my computer...at least I can't find one..
John: Panda showed that the system was clean too...
 
Originally posted by: dragonic
SagaLore: 'cause there aren't any ntsrv.exe files on my computer...at least I can't find one..
John: Panda showed that the system was clean too...

How can you remove something that isn't there? 😕
 
Originally posted by: SagaLore
Originally posted by: dragonic
SagaLore: 'cause there aren't any ntsrv.exe files on my computer...at least I can't find one..
John: Panda showed that the system was clean too...

How can you remove something that isn't there? 😕
well they were on task manager but now after using the computer for a while and restarting they're gone 😕
oh well, gotta be happy that those are gone 🙂
but now my windows update won't work...I see it on my taskbar but it won't show up :| What's wrong with it?
 
Big picture:

1) what version of Norton do you have, hopefully one of the modern ones (2004 or 2005), since that appears to be your real-time protection here. If you want, you can grab a free 15-day trialware of Norton Antivirus 2005 from here. Run LiveUpdate repeatedly, rebooting as prompted, until it comes up happy, then tack on the daily Intelligent Update.

2) is Norton set to use maximum heuristics and to scan within compressed files on both the AutoProtect and the Manual Scan panels in Options; if not, change that.

3) patch your system with the latest Microsoft updates. Microsoft Baseline Security Analyzer is a good tool, it sees deeper than Windows Update does.

4) right-click My Computer > Manage > Users & Groups > Users, and give all the Admin-class accounts a strong password such as dragonic@AT to prevent a no-brainer appropriation of the Admin-class accounts' powers.

5) if you have a router, close the ports you don't need open. Ones you'd probably need open include 20 & 21, 25, 53, 80, 110, maybe 143, and 443. If the computer comes down with another remote-controlled Trojan but can't "call home" to get instructions because the router is blocking port ____ outbound (insert random port the Trojan wants to use), that's partial damage containment at least.

5) be more careful 🙂 This stuff doesn't fall from the sky. Warez, pr0n, P2P and letting other people use your computer are all potential risk factors that are under your control. If others will be using your computer, make sure there's a Limited-class account without password protection for them to use, and protect the Admin-class accounts. Consider using Limited yourself, they're harder to exploit.
 
1. Norton Internet Security 2005 with all the updates I can get through liveupdate
2. Yes, it is
3. System is patched with all the latest security updates
4. yeah, I propably should do so 🙂
5. Don't have router
6. I'll try to more careful 🙂 I think I even know where I got this but since Norton cleared the file I thought it was safe which was a mistake but thankfully, it fixed now.
 
Back
Top