PDA

View Full Version : Ndrv ???? Whats that?

Dark
10th July 2004, 18:23
If i want shut down my computer it dont work. and i have found the problem, its a running process called "Ndrv" if i close it my Computer works again. For what is this File?
luck777jojo
10th July 2004, 23:34
hrm perhaps if you search google it will help, from the few secs I searched it seems to be spyware: http://www.mac-net.com/552484.page
Syphon
10th July 2004, 23:45
NDrv.exe and NDrv.dll appear to be an Adware Program. It is found in c:\windows\system32. On running it it search for valuead.com This is the web site that this program contacts to pull down stuff. An ip address in the .exe file is 66.150.193.11. That address inside the file is actually 66.150.193.111 and it traces to the Internap.com domain.

Could also be linked to:

O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\[username]\Application Data\ttuh.exe
O4 - HKCU\..\Run: [Ohub] C:\Documents and Settings\[username]\Application Data\itro.exe

Removal:

End the below suspicious process :

C:\WINNT\System32\NDrv.exe

Remove these additional browser plug-in keys (fdjfocv.exe) looks suspicious:

O2 - BHO: Curl - {A78CC2FF-6E4E-4556-B27C-D7C3A70D7A50} - C:\WINNT\System32\NDrv.dll
O4 - HKCU\..\Run: [????] C:\Documents and Settings\[username]\Application Data\????.exe
O4 - HKCU\..\Run: [NDrv] C:\WINDOWS\System32\NDrv.exe

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [ljgcrqfdg] C:\WINNT\System32\fdjfocv.exe
O4 - HKCU\..\Run: [NDrv] C:\WINNT\System32\NDrv.exe

Reboot the computer but put it to safe mode. Then delete these files from your C: drive.

C:\WINNT\System32\NDrv.exe
C:\WINNT\System32\NDrv.dll


Just incase people can't follow links.
Dark
11th July 2004, 18:16
thx works now again
JesseC
13th July 2004, 00:28
Speaking of processes. Is it possible to have nvidia drivers in one's PC while having an ATI video card? I have 2 nvidia processes running on startup but I got and ATI Radeon card.
Dark Blaze
13th July 2004, 01:18
why nVIDIA when using ATI Radeon? I find it useless to do such a thing...
luck777jojo
13th July 2004, 11:22
it's possible but it is quite pointless as DB pointed out.
JesseC
13th July 2004, 19:34
The processes are nwiz.exe and NvCpl. I looked them up and apperently they're useless, even if you have an nvida card.
Dark
13th July 2004, 23:42
no it was a spyware software
IHGS
14th July 2004, 03:44
srry to get a little off topic here but dark, do u have aim or anything?
shock
14th July 2004, 05:39
about the graphics card, i bought a vio that came with a radeon 9200 and it has some nvidia crap on it too ;p
JesseC
14th July 2004, 19:50
about the graphics card, i bought a vio that came with a radeon 9200 and it has some nvidia crap on it too ;p

Same here, I stopped both of them from starting at start-up yesterday and it doesn't affect anything, so that's cool. Now I just have to figure out igfxtray and hkcmd.