Virus-like activity - fake ntvdm.exe process - any handlings?
Posted on 2008-10-18
I'm fixing a friend's computer.
Win XP Home
On boot up, the process ntvdm.exe runs, and uses 90-99% of CPU (mostly 99) and slows up system.
When I kill the process the system runs fine.
I renamed ntvdm.exe in WINDOWS/system32/ and rebooted and there is still a 'ntvdm.exe" process on start-up.
I tested system with AVG antivirus 8, Spybot, Ad-Aware and Spyware Doctor but nothing found. I also ran CleanUp.
I've been looking on Google for days now trying to figure this out but no solution yet.
I also ran regedit.exe and looked for instances of 'regedit.exe' and compared the results to my own computer's registry (that one is clean) and they were the same - i.e. there wasn't something planted in the registry in visible format that would give a clue.
As this is my friend's computer I don't have data on usage history but he seems to have downloaded/installed "shady" programs which I made him get rid of, but this could have introduced some cr*pware...
Anybody have an idea how to fix this/where to look - I am trying to do this without wiping the hard drive as then I have to re-install a bunch of other stuff...
Thanks in advance.