Please help with the hook error!

[Rolf]

Yes, I have Spybot and Adaware, as I mentioned in my August 19 posting in this thread. That was shortly after I first bought the game. I ran the CWS Shredder as well. No spyware. Just the hook process that I mentioned in one of yesterday's posts, and I am at a loss as to how to shut it down or even what or where it is on my computer. It certainly doesn't interfere with any other aspect of my computer, only, evidently KoH's copy protection system.

[Angryminer]

Are Spybot and Adaware active while trying to start KoH? They themselves hook around the system, too, while trying to find hook-processes. :wink:

I'm following your progress very closely. Your finding of a Starforce-related hook-process is new to me and will propably help others in the future. Keep going. :go:

Angryminer

[Webmaster]

the .sys file maybe hidden as well ... is your explorer configured to show hidden and system files? elsewise a search doesn't find them!

try the safemode and run the rootkit scanner. is the process running in this mode?

.sys files are mainly in system32 or system32/drivers, but can also placed anywhere


and i must correct me. the ntldr is required in the booting of windows.

[hawk_knight]

I had Norton and my game worked fine. ( Now i have some better antiviirus software :biggrin: )

yes me to

I also have norton on my pc and the game worked fine. i still play koh today on my pc with norton on and had no problem with it :cheers: :go:

[Rolf]

Of course I turned off my virus protection and anti-spyware before putting KoH on my computer. I tried running rookit hook analyzer in safemode but it wouldn't run. I should say that Starforce drivers did NOT come up as hook devices in rookit hook analyzers. I merely saw them among the list of modules and removed them as I had read some time ago that others had problems with the drivers after removing the game that used them. Removing Starforce made no difference on my computer, however.

[Rolf]

Hooray!!!

I finally got rid of the nasty hook process and was able to play the game for the first time. Quite some time ago I had given up looking, as you know if you've followed my thread. Then the Rookit Hook Analyzer finally zeroed in on the problem, a ntctl.sys file that I could not for the life of me locate or connect to any program I was using. Finally, I noticed that Security Task Manager, a German-made product that I downloaded some time ago as shareware (and has helped me find and remove otherwise hidden crap in the past) had the ntctl.sys listed but in the non-shareware section. So I forked out the $29 to download the fully operational program. Bingo! I played the game until 5 a.m. this morning. In closing, let me say that this has been a learning experience for me, although I still don't know what the heck that file was other than it was considered dangerous and was associated with a driver--I quaranteened it, just in case, though I checked over my computer and nothing seems at all adversely affected by the suspicious file's removal. Time to put KoH back into play and see about expanding my foothold into Spain...

[Doux]

Wow, that's great! :go: Thanks for sharing your positive result with the community.

It's strange that google returns no other sites than _this_ for "ntctl.sys". It's not a really common system file name..