Hall of Fame

1. snoopfrogg85,925
2. oBdA75,416
3. dstewartjr62,335
4. Paranorm...61,156
5. McKnife53,797
6. bbao45,259
7. richrumble40,628
8. mkline7138,275
9. johnb676737,201
10. DaveHowe36,256
11. toniur29,970
12. bluntTony29,767
13. CoccoBill26,861
14. rpggamer...25,500
15. Admin3k22,327
16. keith_ala...21,450
17. Americom20,700
18. xmachine18,300
19. Shift-317,100
20. tigermatt16,600
21. demazter16,345
22. MikeHolcomb16,068
23. Chris-Dent15,000
24. Mestha14,450
25. xxdcmast13,933

1. richrumble716,889
2. r-k434,942
3. oBdA378,303
4. Sheharya...355,518
5. trywaredk297,335
6. war1296,544
7. rpggamer...290,883
8. gidds99274,092
9. Phil_Agc...244,228
10. toniur235,529
11. KCTS217,346
12. CoccoBill209,880
13. sirbounty194,693
14. McKnife181,860
15. bbao173,429
16. PeteLong163,654
17. johnb6767161,905
18. sunray_...146,627
19. snoopfrogg134,851
20. Jay_Jay70118,090
21. leew114,761
22. PowerIT98,045
23. mdiglio97,751
24. younghv91,820
25. rindi90,461

	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.4

Internet being hijacked? HijackThis results NVedit.exe, SysHelp.exe, ntng.exe problems?

Asked by chandldj in Windows Network Security

After only a few minutes online, the computer's internet stops working... just recently removed TROJ_DLOADER.F, BKDR_SDBOT.GEN, TROJ_RANKY.AN from house call AV check.

Here are the results of the HijackThis search... i thought questionable files might be NVedit.exe, SysHelp.exe, ntng.exe???

Logfile of HijackThis v1.97.7
Scan saved at 6:07:16 PM, on 08/08/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Documents and Settings\christine\Desktop\Spyware & Virus Removal\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:83
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {34D83701-B51B-50B3-D150-64550DA77A41} - C:\WINNT\system32\tnaoyegz.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [UC_Start] C:\IBMTools\Updater\ucstartup.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Windows Automatic Updater] wupdate.exe
O4 - HKLM\..\Run: [WinsHelps] NVedit.exe
O4 - HKLM\..\Run: [SysHelp] SysHelp.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Automatic Updater] wupdate.exe
O4 - HKLM\..\RunServices: [WinsHelps] NVedit.exe
O4 - HKLM\..\RunServices: [SysHelp] SysHelp.exe
O4 - HKCU\..\Run: [SysHelp] SysHelp.exe
O4 - HKCU\..\Run: [Yaxakea] C:\WINNT\system32\ntng.exe
O4 - Global Startup: Dpcstart.lnk = C:\Program Files\DIRECWAY\BIN\dpcstart.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www.ibm.com/pc/support/access/sdccommon/download/IbmEgath.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38047.4704166667
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB37441D-C066-4474-885A-2D45483F67B4}: Domain = direcway.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB37441D-C066-4474-885A-2D45483F67B4}: NameServer = 66.82.4.8

Please help... thank you in advance,

Dean

View the Solution FREE for 30 Days

	Title
1	Hijackthis
2	hijackthis
3	Assistance with contents of Hijackthis …
4	Help with interpreting HiJackThis log
5	HIJACKTHIS log
6	HijackThis Log

Internet being hijacked? HijackThis results NVedit.exe, SysHelp.exe, ntng.exe problems?

Asked by chandldj in Windows Network Security

About this solution