Fixing the False-Positive Detection of NTDLL.DLL as a Virus

On 3/19/2007, Authentium released a bad definition file that causes Command Antivirus to give a false-positive reading on the file “ntdll.dll”. This only affects Windows 2000 machines. The bad definition file tells Command to flag ntdll.dll as a virus even though it is not infected.

Authentium has already released a new version of the definition file, and we have pushed this new version to our school servers. The problem is that Command’s Dynamic Virus Protection service starts when Windows loads and immediately begins flagging the ntdll.dll file as a virus. This slows the machine down tremendously because it overloads the system resources. Please follow these instructions to turn off the dynamic virus protection and update the definition files.

1. Right-click on the Command Antivirus for Windows system tray icon (located in the bottom right corner by the clock – it is a yellow “C”)

2. Left-Click Configure Dynamic Virus Protection

3. Uncheck the box that says Enable Dynamic Virus Protection and Click OK.

4. Reboot your computer and login to the network so that these settings take effect and Command will download the newest version of the definition files.


Once the definition files have been updated, follow these steps to turn dynamic virus protection back on (NOTE: If these steps are not completed, the system will be unprotected):

1. Right-click on the Command Antivirus for Windows system tray icon (located in the bottom right corner by the clock – it is a yellow “C”)

2. Left-Click Configure Dynamic Virus Protection

3. Check the box that says Enable Dynamic Virus Protection and Click OK.

4. Reboot your computer so that these settings take effect.

If you have any further questions, please contact us via email at mbest@lenoir.k12.nc.us or cdecker@lenoir.k12.nc.us.