What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Naupoint Still Taking Over My Ie

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello, I have a problem with web-site find.naupoint.com which is taking over my home-page of Internet Explorer. On november 6th I reported this problem to you and was helped in a good way. The remedie was to get rid of this trojan horse by fixing my register with the help of Hijackthis in safe mode. The point is that after 1 or 2 days this page is coming back to my computer. Since nov 6th I have removed 'naupoint' about 10 times allready but it keeps coming back allthough I cannot figure out if it is related to any website I am visiting or if it still sticks in my computer somewhere. Uptill now I do not have any scanning software on my system that is able of even recognizing this aggressive webpage as an intruder. I know how to get rid of this page but can you help me in preventing this naupoint thing to enter my computer in the first place or do you know of any software that wille recognize it and remove it ? Thank you for any help. Jos Thijssen, Apeldoorn, Netherlands
Post #2
"josthijs", Hello and Welcome back to TC, :wavey:

Please RUN HJT and Post another Log as an answer

to this thread.

We need to look at you log.

Marty19146 ;)
Post #3
Here you will find my HJ log:
(Naupoint came back to my system just now when I restarted my computer).

Logfile of HijackThis v1.98.2
Scan saved at 19:05:52, on 21-11-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\GIANT Company Software\GIANT AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\GIANT Company Software\GIANT AntiSpyware\gcasDtServ.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Jos\Download setups\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://find.naupoint.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://find.naupoint.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://find.naupoint.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://find.naupoint.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://find.naupoint.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://find.naupoint.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://find.naupoint.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://find.naupoint.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = http://find.naupoint.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://find.naupoint.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Program Files\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 8\LaunchList.exe
O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [VOBID] C:\Program Files\Pinnacle\InstantCDDVD\InstantDrive\InstantDrive.exe /remount
O4 - HKLM\..\Run: [IW ControlCenter] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\GIANT Company Software\GIANT AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Time Zones for PCs.lnk = C:\Sep\Magic\TZPC.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postbank.nl/sesam/CAX.cab
O21 - SSODL: eplrr9 - {7DFC1951-EBB8-4A7B-B42B-D8A9632C8FBD} - C:\WINDOWS\system32\eplrr9.dll


What I normally do in this situation is :
fixing all the items with the text 'naupoint' in them. Also I fix the items
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
and
O21 - SSODL: eplrr9 - {7DFC1951-EBB8-4A7B-B42B-D8A9632C8FBD} - C:\WINDOWS\system32\eplrr9.dll

Fixing the last item gives an error in HijackThis though it seems removed anyway.

Then I go to the other user on my computer and do the same thing.

And this helps until the next day or so. Then it comes back again.

Thank you for any help..

Jos Thijssen
Post #4
Hello again, josthijs

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

(1).
Make sure all browser and all Windows Explorer windows are CLOSED before fixing,

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked.(if they are still present)
(Do not miss any)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://find.naupoint.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://find.naupoint.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://find.naupoint.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://find.naupoint.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://find.naupoint.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://find.naupoint.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://find.naupoint.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://find.naupoint.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = http://find.naupoint.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://find.naupoint.com

O21 - SSODL: eplrr9 - {7DFC1951-EBB8-4A7B-B42B-D8A9632C8FBD} - C:\WINDOWS\system32\eplrr9.dll

(2).
*Restart the computer.
*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
*Use the arrow keys to select the Safe mode menu item
*press Enter.

(3).
Please find and delete this file Highlighted in RED.
C:\WINDOWS\system32\eplrr9.dll
(4).
Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, be sure to also select delete all offline content.Then your RECYCLE BIN.

(5).
Reboot in regular mode when finished troubleshooting

(6).
Please run and repost a new HJT log in your reply to this post.

We will need to check your LOG again…Marty <_<
Post #5
Hello Marty,

Thank you for responding..
I tried to fix the naupoint things with HijackThis in normal mode and some were fixed (including O21 - eplr99.dll) but several of them would not go. They could not be fixed in normal mode.

So I went into safe mode and then I could fix all the naupoint things.
Then I logged out off my account and logged on on the accounts of my 2 sons who also use this machine. There I also fixed the naupoint things (apparently there are somewhat different register-settings for different users). In the end no user had any naupoint thing left in his register.
Then I did all of the rest of things you advised.

Here is my log :

Logfile of HijackThis v1.98.2
Scan saved at 19:08:27, on 22-11-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Jos\Download setups\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\\jos\interpagina's\algemene startpagina.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\\jos\interpagina's\algemene startpagina.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Program Files\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 8\LaunchList.exe
O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [VOBID] C:\Program Files\Pinnacle\InstantCDDVD\InstantDrive\InstantDrive.exe /remount
O4 - HKLM\..\Run: [IW ControlCenter] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Time Zones for PCs.lnk = C:\Sep\Magic\TZPC.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postbank.nl/sesam/CAX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab


It looks clean now, but this is a situation I had before.
New for me is that I deleted eplrr9.exe which I did not do before.
I hope this Naupoint-thing will not return in one or two days.
Lets see and thank you up till now.

Jos Thijssen
Post #6
Hello again, Naupoint has been away for about 24 hours. And now it is back again. In the mean time me and my son have started and stopped the computer several times without having any problem. Could it be that the Naupoint thing is hiding somewhere in my computer and returns after a certain time ? Could there be some automatic recovery to an old register setting ? What can I possibly do to prevent this thing from coming back after a day or so ? Greetings, Jos Thijssen
Post #7
Hello again,

I fixed the Naupoint things again in safe mode and now I do not have any problem.
However it seems to be in my system. When I make a report with CWShredder I do find, among other things, the following lines :

**** Custom IE Search Items ****

SEARCH: [CustomizeSearch] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
SEARCH: [SearchAssistant] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
SEARCH: [Search Page] http://find.naupoint.com
SEARCH: [Start Page] http://find.naupoint.com
SEARCH: [Local Page] http://find.naupoint.com
SEARCH: [First Home Page] http://find.naupoint.com

While HijackThis does not report any naupoint thing.
It seems to me that Naupoint is still in my system. Do you know where I can remove those 'Custom IE Search Items' ?

Thank you,

Jos Thijssen
Post #8
Hello again, josthijs

Please print out or copy this page to Notepad.

(1).
Lets try this: Do the suggested Fix in my previous Posts.
For every user on your machine.(log-in one at a time)

(2).
Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

1. Right-click My Computer, and then click Properties.
2. On the Performance tab, click File System, or press ALT+F.
3. On the Troubleshooting tab, put a check mark in the 'Turn Off System Restore' check box.
4. Click OK twice, and then click Yes when you are prompted to restart the computer.
5. Repeat steps 1 - 3, this time clearing the box beside 'Turn Off System Restore'
(3).
Be sure to Reboot after every step mentioned.

(4).
Please run and repost a new HJT log in your reply to this post.


We will need to check your LOG again…Marty <_<
Post #9
Hello Marty,

Thank you for coming back to my problem.
I fixed the register for all users and deleted eplrr9.ddl, all in safe mode.
Then I rebooted and reseted and re-enabled System Restore, however I could not find the tabs you mentioned:

I have windows XP and instead I did:
Right-click My Computer -> Properties -> System Restore tab -> Check Turn off System Restore -> Apply -> OK –>
Reboot->
Right-click My Computer -> Properties -> System Restore tab -> Uncheck Turn off System Restore -> Apply -> OK –>

I'm still not on the Internet..

My system seems clean now (naupoint is no longer my startpage), but I think it is not clean because of 2 funny things:
1) when I try to put '*.naupoint.com' to the list of forbidden websites, IE says that he can not do it, because it is allready in a list elsewhere (I have no problem putting some other website on thos list)
2) when I run a report with CWShredder, it still reports Naupoint things.
To me it seems that Naupoint is still on my computer somewhere…

I'm still not on the Internet..

Here is my HJT log :

Logfile of HijackThis v1.98.2
Scan saved at 18:54:30, on 24-11-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Jos\Download setups\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\\jos\interpagina's\algemene startpagina.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\\jos\interpagina's\algemene startpagina.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Program Files\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 8\LaunchList.exe
O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [VOBID] C:\Program Files\Pinnacle\InstantCDDVD\InstantDrive\InstantDrive.exe /remount
O4 - HKLM\..\Run: [IW ControlCenter] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Time Zones for PCs.lnk = C:\Sep\Magic\TZPC.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postbank.nl/sesam/CAX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab

Would you care for a log of one of the other users ?

Thank you,

Jos Thijssen
Post #10
Hello Marty, Naupoint is back again. Within 20 hours. The one funny thing I mentioned about not being able to put naupoint.com on the forbidden websites is cleared. The reason was that I had ie-sypad2 installed. When I removed the list of ie-sypad2 I could put naupoint.com on the forbidden list. The other funny thing (CWShredder reports naupoint) is still true. Just now I ran the housecall of Trendmicro's antivirus and my system does not have any virus. Do you have any idea of what next ?? Greetings, Jos Thijssen
Post #11
Hello again, I'm sorry to keep sending information, but I was still working on this Naupont thing. Now I also understand why CWShredder still reported naupoint in it's log. This was because Naupoint was still in the registry after fixing with HijackThis ! What I did was : ->Go into safemode -> Use Hijackthis to remove all items of naupoint, including the Local Page= (with nothing) and including O21-eplrr9.ddl -> do this for every user on the system -> delete file c:\windows\system32\eplr99.dll -> start regedit and search for naupoint. -> change the contents find.naupoint.com with google.com (Apperently HijackThis did not reckognize these entries as malicious) Now my registry is clean, also according to CWShredder. Let's see if it over now. Greetings, Jos Thijssn
Post #12
Hello again, josthijs

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
(I know you have most of the programs already, but a review won’t hurt.)
  • Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

  • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

    A tutorial on installing & using this product can be found here:

    Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

  • Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

    A tutorial on installing & using this product can be found here:

    Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

Marty :D
Post #14
Hello Marty and colleagues, Naupoint is back on my system within 20 hours ! The best I could achieve so far is to get rid of Naupoint for half a day or so. What can I do ? Maybe walking through evrything once again: 1. Update my (McAfee)Virus-checker, (McAfee)Firewall, Spybot, AdAware, Windows, Spywareblaster, Hijackthis. 2. Go in safe mode and run Spybot, Adware and Virusscanner. 3. Delete all history, tempfiles and cookies with IE for every user on the system. 4. Fix all Naupoint things with HijackThis including eplr99.dll for all users and deleting and delete eplr99.dll. Empty Recycle-bin. 5. Run regedit and rename all remaining naupoint-websites with (for example) google websites. Do this for every user. 6. Turn off System Restore and reboot. 7. Go in safe mode and Turn on System Restore. Or… Send you a HJK log of every user on my system. What do you think ???
Post #15
Hello again, josthijs

The Following is a Post from another forum:

I wrote that my ie was hijacked by naupoint.com well for days I have been freaking out. In the top left corner as small as can be there was a unseen uninstall link. I did it and it worked. what a crock of ****……….it even apologized if it caused any inconvienence.


See if you can find that UNISTALL LINK.

Please let us know how you made out.

Marty <_<

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI