+ Post New Thread
Results 1 to 15 of 15
Windows Thread, ddnt.sys in Technical; Had two teachers down today with Symantec saying it has detected ddnt.sys in system32/drivers as a virus of hacktool.rootkit. I'm ...
  1. #1

    MK-2's Avatar
    Join Date
    Oct 2006
    Location
    Nottingham
    Posts
    3,237
    Thank Post
    149
    Thanked 581 Times in 307 Posts
    Blog Entries
    8
    Rep Power
    200

    ddnt.sys

    Had two teachers down today with Symantec saying it has detected ddnt.sys in system32/drivers as a virus of hacktool.rootkit.
    I'm assuming its the definition update that has now listed something we already had installed but I can't find any reference to ddnt.sys

    Help plz!?!

  2. #2

    MK-2's Avatar
    Join Date
    Oct 2006
    Location
    Nottingham
    Posts
    3,237
    Thank Post
    149
    Thanked 581 Times in 307 Posts
    Blog Entries
    8
    Rep Power
    200

    Re: ddnt.sys

    it's not on my desktop but has been on the 4 laptops i have checked so far, so i'm guessing something like promethean install or some software we have loaded on to all laptops

  3. #3

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,820
    Thank Post
    110
    Thanked 590 Times in 511 Posts
    Blog Entries
    1
    Rep Power
    226

    Re: ddnt.sys


  4. #4

    webman's Avatar
    Join Date
    Nov 2005
    Location
    North East England
    Posts
    8,413
    Thank Post
    642
    Thanked 964 Times in 664 Posts
    Blog Entries
    2
    Rep Power
    327

    Re: ddnt.sys

    We had this problem yesterday with the latest Symantec definitions, and it only seems to have occured on a handful of teachers' machines. I couldn't get a copy of the file to inspect though (Symantec deleted it each time).

  5. #5

    MK-2's Avatar
    Join Date
    Oct 2006
    Location
    Nottingham
    Posts
    3,237
    Thank Post
    149
    Thanked 581 Times in 307 Posts
    Blog Entries
    8
    Rep Power
    200

    Re: ddnt.sys

    I saw the dinkey dongle thing but as far as I'm aware nobody has anything like that.
    I have a machine where i can see the file but haven't accessed it yet so i'll try to stop symantec and see.

  6. #6

    TechMonkey's Avatar
    Join Date
    Dec 2005
    Location
    South East
    Posts
    3,307
    Thank Post
    226
    Thanked 414 Times in 306 Posts
    Rep Power
    163

    Re: ddnt.sys

    Someone else has reported this on the RM forum. They are saying that it is part of ActivStudio2 and is located in windows\system32\drivers\.

    HTH

  7. #7

    MK-2's Avatar
    Join Date
    Oct 2006
    Location
    Nottingham
    Posts
    3,237
    Thank Post
    149
    Thanked 581 Times in 307 Posts
    Blog Entries
    8
    Rep Power
    200

    Re: ddnt.sys

    yeah it was in /drivers. i had a feeling it was promethean related as there's not much else that is rolled out across the whole laptops.
    cheers for that

  8. #8

    MK-2's Avatar
    Join Date
    Oct 2006
    Location
    Nottingham
    Posts
    3,237
    Thank Post
    149
    Thanked 581 Times in 307 Posts
    Blog Entries
    8
    Rep Power
    200

    Re: ddnt.sys

    Just an update, we still have ActivStudio2 installed and it's on the first cd of that. The cd where you install the driver or the actual software etc.
    I don't know if this is the same for v3, I also don't know if Symantec quaratining or deleting this file adversely affects the boards operation.

    Does anyone know which email addy you send false positives to symantec?

  9. #9

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,820
    Thank Post
    110
    Thanked 590 Times in 511 Posts
    Blog Entries
    1
    Rep Power
    226

    Re: ddnt.sys

    http://www.symantec.com/avcenter/submit.html

    Also, you should inform Promethean.

  10. #10

    MK-2's Avatar
    Join Date
    Oct 2006
    Location
    Nottingham
    Posts
    3,237
    Thank Post
    149
    Thanked 581 Times in 307 Posts
    Blog Entries
    8
    Rep Power
    200

    Re: ddnt.sys

    Thanking you muchly

  11. #11
    nawbus's Avatar
    Join Date
    Jun 2005
    Location
    Newcastle-under-Lyme, Staffordshire
    Posts
    186
    Thank Post
    47
    Thanked 6 Times in 6 Posts
    Rep Power
    21

    Re: ddnt.sys

    I've just reported it to Promethean, just waiting for a reply.

  12. #12
    Jobos's Avatar
    Join Date
    Apr 2007
    Posts
    1,153
    Thank Post
    184
    Thanked 52 Times in 45 Posts
    Rep Power
    26

    Re: ddnt.sys

    We’ve got the same problem. Activboard is installed on most of the schools machines even when there’s no board attached as the kids like the games on them. I’ve extracted the ddnt.sys file from a ghost image we have dating back to August last year and that’s being detected as a virus so I’m hoping that it’s a false positive.

  13. #13
    Jobos's Avatar
    Join Date
    Apr 2007
    Posts
    1,153
    Thank Post
    184
    Thanked 52 Times in 45 Posts
    Rep Power
    26

    Re: ddnt.sys

    Support at Promethean say it’s a left over file from the usb dongle that they use a while back. If you are using the latest version of Activboard and driver the file can be deleted

  14. #14
    nawbus's Avatar
    Join Date
    Jun 2005
    Location
    Newcastle-under-Lyme, Staffordshire
    Posts
    186
    Thank Post
    47
    Thanked 6 Times in 6 Posts
    Rep Power
    21

    Re: ddnt.sys

    Just had this e-mail from Promethean -
    Thankyou for bringing this to our attention. We have already had another antivirus program identify this as a virus, but thankyou for letting us know about yours.

    The file in question was used for a product we used to supply. On the newer versions of the software, this file was re - written, and thus does not cause any problems with antivirus software.

    Please note, the file in question is absolutely fine, and is indeed not a virus. If you require to, you can simply remove the file, or tell the antivirus program that it is not a virus, and for it to be excluded from the virus list.


    Thankyou again for bringing this to our attention, but as I say, there is nothing to worry about with the file in question.

  15. #15

    Join Date
    Jul 2005
    Location
    Lancashire
    Posts
    141
    Thank Post
    2
    Thanked 2 Times in 2 Posts
    Rep Power
    19

    Re: ddnt.sys

    yeah, that comment was from me via support. yes ddnt.sys is from the dinkey dongle usb driver, this is the dongle we used for older panels and tablets. Older models of those tablets couldnt provide the hardware key to activstudio to remove the watermark and enable all features, hence the dongle. These days it isn't needed but we include the driver in the software install in case anyone is using older software.

    Thanks to your reports (and also one from denmark) we have fixed this and future releases of the software shouldnt have this problem. The antivirus programs are flagging it up as a rootkit I believe, however not all of these are malicious and this isn't really behaving like a rootkit. The antivirus is mistaking the way it monitors for a USB device as a virus.

    currently it is safe to add this to the exclude list or delete the file if you arent using a dongle.

SHARE:
+ Post New Thread

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •