How to stop ntndis.sys from loading at startup?

franpa · Post by **franpa** » Sun Feb 17, 2008 4:10 am

this file is part of a virus and i have it removed yet windows still try's to load it thus shows a error box on startup every time about it missing. how do i stop it trying to load it?

32107 is uploading a viurus'd Embrace keygen for nero 8 @ piratebay.

BKDR_SDBOT.RV

franpa · Post by **franpa** » Sun Feb 17, 2008 5:49 am

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

i worked it out ^^ there was a EXE file being launched upon Windows Logon and is called NTNDIS.EXE. in the above registry key you will find something called 'Shell' that points to the exe file. just delete it and then delete the following files found in 'C:\Windows\System32\Drivers'

NTNDIS.EXE
NTNDIS.SYS

whicker · Post by **whicker** » Sun Feb 17, 2008 8:27 am

franpa,

you should really look into running your questionable software in a virtual machine with an undo disk. When the, *ahem*, session is over, just choose to not save changes.

franpa · Post by **franpa** » Sun Feb 17, 2008 9:11 am

Oh, excellent idea!. i'll look into that.

adventure_of_link · Post by **adventure_of_link** » Mon Feb 18, 2008 7:26 pm

also, another reason why you should be careful as to what you download.

that said, I would recommend Microsoft's Virtual PC in windows.