Hijackthis Log

Well the first two found nothing and Panda is still running. I'll have to go soon, but I wanted to let you know that those files navmgrd and wkssvr that I deleted came back after reboot. I deleted them in regedit again just for kicks(what could one more try hurt I thought). They dissapeared until I rebooted. I almost got excited for a min.

If you need to delete them again, do this right after you close regedit:

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Click Start> My Computer, select the Tools menu and then Folder Options, after the new window appears select the View tab…]
This time select the: Restore Defaults
Select: Apply, and click OK

Panda found no viruses either.

Try my last post to see if they stay gone. Where are they listed in the registry?

Yes, I found them using regedit again. Also my system restore has been off for weeks. maybe longer. since "they" say to remove some viruses you have to turn it off. I turned it off a long time ago and never turned it back on. Maybe a month or so ago. I have a bad since of time. Is it bad to have it off? And if I just delete them and reboot and turn system restore on again will that work?

Yes you should have System Restore On..


Restart your computer in Safe Mode.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.

Now run regedit and delete those.

Also while in regedit, look for this sp.html If you find it, let me know where it's at,

Lets see if that works.

no sp.html file was found. I did find, however, a few wkssvr.exe and navmgrd.exe files and deleted them all. I then rebooted (not in safe mode) and looked in regedit again, and low and behold there they were. so I deleted and searched again immediately after. found this HKey_USERS>S-1-5-21-602162358-2111687655-854245398-1003>Software>Resplendence sp>Registrar Lite>Settings in that file lots of files listed. the only one I saw that had navmgrd.exe in it was ComboBoxSearchTaxt………navmgrd.exe Wild Tangent. At reboot they came back again.

I don't think we've done this one. They has to be a hidden / trigger file somewhere


Please download rem.zip from here

http://forums.skads.org/index.php?act=Attach&type=post&id=83

unzip the files to C:\Windows\system32

Restart your computer in Safe Mode.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.

Now run the Rem.bat file.


If it produces a log.txt file please copy/paste it here along with a new HijackThis log after a normal reboot.

Explain… Not sure how you mean

unzip the files to C:\Windows\system32


I downloaded to my desktop and did not yet unzip. I'll be back in about 5 hours.

If I'm lucky work carries over frequently.

When you double click the rem.zip, you can tell it where to unzip them to. unzip the files to C:\Windows\system32

I might have found it:

Do this please:

Also, be sure that all windows are closed. Click on START-> RUN. Copy paste the following as it is and click OK.

regsvr32.exe /U njofc.dll

You should get a message that it has been uninstalled succesfully.



copy/paste" a new log file into this thread.

I deleted that file a week ago or so remember? I think… will do again

Let me know if You get a message that it has been uninstalled succesfully

Well, I got a message anyway… LoadLibrary("njofc.dll) failed - The Specified module could not be found.

"copy/paste" a new log file into this thread.