Member Avatar for jaishankar

ntfds.exe, winrbd32.exe, mwupdate32.exe

Can any one tell me wat are these, these files were not in the running process before connecting to internet, i just install win2000 with service pack 4 and IE6, and connected to net and wat i saw is these programs were running and consuming huge amount of memory

  • 2 Contributors
  • 5 Replies
  • 139 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by DMR

Dani AI

Generated

Short summary and next steps after the initial cleanup by and the identification from : those process names are commonly used by malware, and deleting the visible files is only the first step. The important work is verifying there are no hidden components left, removing any autostart hooks, and confirming system integrity before trusting the machine again.

Practical checklist (run these in order)

  • Update signatures and run a full scan with your antivirus, then run an additional on-demand scanner such as the Microsoft Safety Scanner ().
  • Boot an offline scanner if you suspect rootkit activity (Windows Defender Offline or similar) and scan from outside the running OS.
  • Use Autoruns to find and remove leftover autostart entries (Startup, Services, Scheduled Tasks, Explorer shell extensions): Autoruns.
  • Inspect Task Scheduler, Services (services.msc), the hosts file, browser extensions, and any unfamiliar network drivers. Run sfc /scannow to check for corrupted system files.
  • If anything looks suspicious or reappears after reboot, consider a rescue-boot scan or a full image-based backup and reinstall.

Post-cleanup hygiene

  • Change all important passwords from a known-clean device.
  • Keep Windows and software patched.
  • If there is any doubt about complete removal (persistent processes, reappearing autostart entries, or evidence of data theft), a clean OS reinstall is the safest option. Microsoft’s step-by-step guidance on removing a virus offers a solid checklist to follow: .

Recommended Answers

All 5 Replies

Member Avatar for DMR

Those files are components of malware (virus, spyware, adware) infections. :(

Please read the malware removal information in this thread and try the suggestions given there. If you have further questions about the infections or their removal, please start an entirely new thread in our Viruses, Spyware and other Nasties forum.

Member Avatar for jaishankar

Those files are components of malware (virus, spyware, adware) infections. :(

Please read the malware removal information in this thread and try the suggestions given there. If you have further questions about the infections or their removal, please start an entirely new thread in our Viruses, Spyware and other Nasties forum.

Thanx 4 ur suggestion, i have solved this problem, those files were not deleting, thankfully i had another OS installed, i booted into it and deleted these files from WINNT-System32 folder and cleaned the startup entries using Reg Cleaner

Member Avatar for DMR

I'm glad you were able to delete the malicious files and their associated "Run" entries in the Registry, but I'd suggest that you now do a couple of full anti-virus/anti-spyware scans to clean out the rest of the components of the infections. These days, infections are rarely comprised of a single file and a single simple adddition to the Registry.

Member Avatar for jaishankar

ok i will do it thanx

Member Avatar for DMR

You're welcome :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.