How to remove the ntuser virus
Most antivirus programs identify ntuser.dll as malware, e.g. Microsoft identifies it as Trojan:Win32/Opachki.A, and TrendMicro identifies it as TROJ_BREDO.D or TROJ_LAMEWAR.VTG.
The free file information forum can help you find out how to remove it. If you know more about this file, please leave a comment or a hint for other users.
Click to Run a Free Virus Scan for the ntuser.dll malware
Ntuser.dll file information
The process known as Application appears to be part of software Microsoft by Microsoft (www.microsoft.com).
Description: The file ntuser.dll is located in a subfolder of "C:\Documents and Settings" or sometimes in a subfolder of "C:\Program Files".
Known file sizes on Windows 7/XP are 25,088 bytes (37% of all occurrences), 24,064 bytes or 23,552 bytes. 
A .dll file (Dynamic Link Library) is a special type of Windows program containing functions that other programs can call. This .dll file can be injected to all running processes and can change or manipulate their behavior.
The process starts when Windows starts (see Registry key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run).
File is hidden. The file is not a Windows core file.
ntuser.dll is able to manipulate other programs.
Therefore the technical security rating is 86% dangerous, however also read the users reviews.
Recommended: Identify ntuser.dll related errors
Important: Some malware camouflages itself as ntuser.dll, particularly when located in the c:\windows or c:\windows\system32 folder. Therefore, you should check the ntuser.dll process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.
Score
User Comments
Ntuser scanner
Security Task Manager shows all running Windows tasks including embedded hidden functions (e.g. keyboard or browser monitoring, autostart entry). A unique security risk rating indicates the likelihood of the process being potential spyware, malware, keylogger or a Trojan. MalwareBytes detects and removes sleeping spyware, adware, trojans, keyloggers, malware and tracking threats from your hard disk. Ideal supplement to Security Task Manager. SpeedUpMyPC scans, cleans, repairs and optimizes your computer. |
Other processes
winadctl.exe ldrtbdvdv.dll dphost.exe ntuser.dll nsvsvc.exe xunleibho_v14.dll odbcasvc.exe isregspy.exe wvsvc.exe ctsvolfe.exe settdebugx.exe [all]
Mike