Hello, I have been trying to remove this by myself, Mainly because it stops all clicking action, So I couldn’t get any =Z I’ve done a bit
I found it was a process called ntndis.exe I looked for it in hijackthis and found it, I fixed it but it hasn’t solved it. On startup, I couldn’t get to the desktop because it froze, I managed to fix that through hijackthis, but I can get on now but anywhere I click doesn’t do anything unless in safe mode 80% of the time. I turned off system restore
This is my hijackthis log and Picture of SuperAntiSpyware scan.
I’m gonna do a scan on avast at some point. It did find something once but I couldn’t see the message, but I couldn’t click. But I don’t know
While not being well versed in the interpretation of HJT logs, a couple of things seem odd to me.
you are running it from the desktop. It should be normally run from the program files, where it should have been installed.
The 04 item WIN32APIH.exe has no Googel reference, is similar in name to a valid Ms file (win32api.exe) and is thus suspicious.
I don’t know about the checkdisk routines suggested above, even having skimmed through the KB articles linked.
What I would do is schedule a boot scan with Avast. If that fails to address the issue, look to run some rootkit scans.
Trend Micro make a free download called rootkit buster, Sophos have an anti rootkit tool, have a look here http://andymanchesta.com/ for a choice of scanners.
SAS is highly regarded, so is MBAM. I’d try it. I think you can update it and run it in safe mode, with networking. Don’t know if it can be installed in safe.
