Reading Error NTOS.EXE

Discussion in 'malware problems & news' started by crazy_cool2k, Apr 12, 2007.

Thread Status:
Not open for further replies.
  1. crazy_cool2k

    crazy_cool2k Registered Member

    Joined:
    Nov 1, 2006
    Posts:
    13
    Hi,
    Yesterday night my computer got infected by some virus/trojan.
    I was downloading a file off megaupload and i got a popup from spybot S&D that my winint file was being modified. I disallowed it but it kept on popping up, so i selected it to remember the selection and disallowed it again.

    Today morning i am not able to connect to my internet and i could see the same popup from SPYBOT S&D warning about changes being made to the winint file but it was being disallowed automatically as i had earlier selected the option.It was constantly popping up and being disallowed automatically.

    I realised something was wrong and tried to connect to the internet but could not. Tried doing a system restore to difft dates but could not. Did a powercycle for the broadband modem but it still would not connect. Pinged the Internet Service Provider and it was successful in pinging the remote server.

    I uninstalled the SPYBOT S&D as it was furiously popping up the warning for the changes being made to the winint file. Then ran the AVG Antivirus saw a error " ntos.exe Reading Error".

    Tried to go to c:\windows\system32\ntos.exe and tried to run it but it said it was in use by another program.

    My AVG antivirus is uptodate and is updated automatically every morning. My windows firewall was unknowingly switched off dont know how because i remember checking on it and switching it on few days back. SPYBOT S & D is currenlty uninstalled but was uptodate till yesterday. Adaware is installed and updated till yesterday but havent yet run it.

    Computer is booting up but is not able to connect to the internet using a broadband connection.

    I understand this could be a trojan / malware issue.

    Please suggest a remedy.
     
  2. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,695
  3. fcukdat

    fcukdat Registered Member

    Joined:
    Feb 20, 2005
    Posts:
    569
    Location:
    England,UK
    Try hitting it with another free botkiller:)
    http://www.superantispyware.com/

    NTOS is known bad trojan although there are new repacks appearing every2-3 days from the sources that i harvest:'(
     
  4. Upham

    Upham Registered Member

    Joined:
    Apr 15, 2007
    Posts:
    2
    Location:
    Delfzijl, The Netherlands
    i got the exact same problem, let me know if you got a solution to this

    Edit: so i tryed the superantispyware and now the ntos.exe seems to be gone, but i still cant get on internet.
    i dont get a ip adress from my router. a fixed ip adress doesnt work either.
    the firewall turning off by itself seems to be fixed though.
     
    Last edited: Apr 15, 2007
  5. woodensword

    woodensword Registered Member

    Joined:
    Apr 15, 2007
    Posts:
    1
    Ok,

    I read the Secure Science corps paper regarding the ntos.exe and followed the removal instruction that it suggests.

    To my frustation by deleting the ntos.exe file i could never log on to windows again. I searched throught the net but i could not find any solution rather than deleting the file ntos.exe and registry keys after closing winlogon.exe handle to ntos.exe.

    No antivirus/security program seems able to remove the malware.

    Nevertheless the solution that worked with me and i would like to share was after simply after deleting the ntos.exe restoring the windows registry from a point:

    http://www.housing.hawaii.edu/resources/su...store-point.htm

    Thank you
     
  6. SUPERAntiSpy

    SUPERAntiSpy Developer

    Joined:
    Mar 21, 2006
    Posts:
    1,088
    You may wish to run our LSP Chain Repair (located in the Repairs tab of SUPERAntiSpyware) - you could have a corrupt LSP chain and that's why you are not getting Internet Access.
     
  7. Upham

    Upham Registered Member

    Joined:
    Apr 15, 2007
    Posts:
    2
    Location:
    Delfzijl, The Netherlands

    thanks alot, it helped :D
    you saved me :)
     
Loading...
Thread Status:
Not open for further replies.