malwarebytes krasches sytem trying to remove rootkit?

[Laston]

Hi! i give virussupport at a forum and now i have 2 computers which crasched when malwarebytes tried to remove

C:\WINDOWS\system32\Drivers\ntndis.sys (Rootkit.Agent) -> Delete on reboot.

Is this a Fp or what?

Mvh Laston

[Maurice Naggar]

Howdy,

These aren't your systems ? right?

This is not a false positive. That driver is a rootkit trojan

Other specialized tools will have to be run to identify all components and then removal by other means.

[Laston]

No its my systems,its users who whanted my help with there infected computors!

Too bad they scanned with Malwarebytes and when restarting the system would not start and its not posible to get in to their system!

I had no other solution then too get a new install,do you have a better solution??

(Sorry for my bad english,im from sweden)

Mvh Laston

[Maurice Naggar]

With this infection (given also it has a backdoor capability), the safest thing is to "wipe" the system and do a clean (new) install.

Yes, they would lose their personal information, unless they made a selective backup before.

There are other means of starting the system, via Recovery Console for example, or from a special boot CD, like UBCD4Win.

Those obviously need special guidance and careful use.

I'm sorry to hear the systems are not useable. But that just points out, when dealing with malware infections, one needs to have special measures to have a way back. That is why, for example, I have people use ERUNT before starting any cleanup. And getting reports (only) first before starting a removal.

[GT500]

Just for reference:

http://www.threatexpert.com/files/ntndis.sys.html

[Laston]

Thx for the replys,i have to keep looking for a program that could handle this bad file because either Mbam or ComboFix seems too be able to clean it out!

Not an easy one too handle because it dont show up in the logs

[Haider]

Hello Laston:

Sorry to hear that your system is infected. Please read and follow the instructions in I'm infected - What do I do now? An Expert will assist you in removal process. Should you have any further question(s) please post back

[noknojon]

Hi Laston -

No its my systems,its users who whanted my help with there infected computors!

The above item by Haider, post #7 , is directed to your people that have problems and would like to join our forum for help -

Any people are able to join our forum and get help from the experts by following those directions provided -

Thank You -

[Laston]

Hello Laston:

Sorry to hear that your system is infected. Please read and follow the instructions in I'm infected - What do I do now? An Expert will assist you in removal process. Should you have any further question(s) please post back

I DO NOT have an infected computor,i give support to people who have infections at a swedish forum so dont treat me as a rookie

Mvh Laston

[sho-dan]

I DO NOT have an infected computor,i give support to people who have infections at a swedish forum so dont treat me as a rookie

Mvh Laston

Hello Laston

At times a question might get a bit lost in translation and the reply may be out sync. By all means your not a rookie, I see your a Moderator at the Swedish forum and a job well done.

Google translator:

Hej Laston

Ibland en fr

[Laston]

Hi sho-dan yes thats correct im a moderator with specialty too clean infected systems at http://www.antispywareforum.se/phpBB/index.php

and 2 others where im not moderator, i realy hate to fail in my work so thats wy i posted in this forum to get a little bit wiser

Mvh Laston