<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: What is ntuser.dll, How to remove ntuser.dll</title>
	<atom:link href="http://htlogs.com/what-is-ntuser-dll-how-to-remove-ntuser-dll/feed/" rel="self" type="application/rss+xml" />
	<link>http://htlogs.com/what-is-ntuser-dll-how-to-remove-ntuser-dll/</link>
	<description>HIJACKTHIS ITEMS/REGISTRY ITEMS/HOW TO REMOVE</description>
	<lastBuildDate>Mon, 14 Feb 2011 12:06:24 -0600</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.5</generator>
	<item>
		<title>By: Ben</title>
		<link>http://htlogs.com/what-is-ntuser-dll-how-to-remove-ntuser-dll/#comment-3420</link>
		<dc:creator>Ben</dc:creator>
		<pubDate>Mon, 07 Dec 2009 13:55:30 +0000</pubDate>
		<guid isPermaLink="false">http://htlogs.com/?p=918#comment-3420</guid>
		<description>Please look for file name &#039;Nsrbgxod.bak&#039; in your windows/internet temp directories or the registery key you meantioned. You will be unable to delete it due to it opening processes on your machine. It will recreate the registery key under your windows run directory so even if you shut down and reboot it will reinfect your machine.

If you find it there are a couple of steps, other wise you will just need a good spyware remover and an antivirus software that is up todate.

If you find either the registery (as above) or the file then first:

Download a spyware remover and run a full scan when it finishes fix everything. (this may be an issue if your machine web browser keeps redirecting you to another site and not letting you down load the software, you may have to use a different machine and download and burn the spyware software to CD or persist and try downloads.com to get a clean download without redirection)

Spyware doctor (this is the best for this kind)
Spybot - Search &amp; Destroy (this is free and had a great ability to plug exploits in IE) &lt;--did not actually find this picked up the problem. (however once I fix the issue this can plug the exploits in your IE or firefox that allow these things to slip through) 
Trend Microsystems &lt;- did not use but is recommened on a lot of the forums.

This will remove the spyware/Trojan that will keep putting in the registry edit to run a script that re infects your machine every time the antivirus removes the problem.

You will need to also make sure you have a  antivirus like Symantec, make sure the defintoins are up todayte and run a full scan. It may report a Bloodhound.Exploit so have the antivirus fix/Quarantine the files. 

Delete everything in your personal temp directory (run/%temp%) and windows temp directory (run/temp)

Next run regedit  make sure the key you found in the ‘Run’ directory with the ‘Rundel32.exe’ in it is deleted, if not delete it. 

This particular spyware/trojan is combining a couple of different known 

*Bloodhount.Exploit - captalises on a couple of weaknesses in Adobe Acrobat and IE
*Trojan:Win32/Opachki.A - is a trojan that runs at Windows start and redirects search queries while monitoring user Internet traffic
*Nsrbgxod.bak - trojan.agent (above) which seems to be a rootkit infection

Please note that most Antivirus will not pickup malware or spyware very well, but i find if you have a combination at lease two different spyware scanners and a good antivirus program that is regulary updated you should be pretty safe. 

As always check you patch level, i suggest you download the latest &#039;Microsoft Baseline Security Analyzer&#039; from the microsoft website.</description>
		<content:encoded><![CDATA[<p>Please look for file name &#8216;Nsrbgxod.bak&#8217; in your windows/internet temp directories or the registery key you meantioned. You will be unable to delete it due to it opening processes on your machine. It will recreate the registery key under your windows run directory so even if you shut down and reboot it will reinfect your machine.</p>
<p>If you find it there are a couple of steps, other wise you will just need a good spyware remover and an antivirus software that is up todate.</p>
<p>If you find either the registery (as above) or the file then first:</p>
<p>Download a spyware remover and run a full scan when it finishes fix everything. (this may be an issue if your machine web browser keeps redirecting you to another site and not letting you down load the software, you may have to use a different machine and download and burn the spyware software to CD or persist and try downloads.com to get a clean download without redirection)</p>
<p>Spyware doctor (this is the best for this kind)<br />
Spybot &#8211; Search &amp; Destroy (this is free and had a great ability to plug exploits in IE) &lt;&#8211;did not actually find this picked up the problem. (however once I fix the issue this can plug the exploits in your IE or firefox that allow these things to slip through)<br />
Trend Microsystems &lt;- did not use but is recommened on a lot of the forums.</p>
<p>This will remove the spyware/Trojan that will keep putting in the registry edit to run a script that re infects your machine every time the antivirus removes the problem.</p>
<p>You will need to also make sure you have a  antivirus like Symantec, make sure the defintoins are up todayte and run a full scan. It may report a Bloodhound.Exploit so have the antivirus fix/Quarantine the files. </p>
<p>Delete everything in your personal temp directory (run/%temp%) and windows temp directory (run/temp)</p>
<p>Next run regedit  make sure the key you found in the ‘Run’ directory with the ‘Rundel32.exe’ in it is deleted, if not delete it. </p>
<p>This particular spyware/trojan is combining a couple of different known </p>
<p>*Bloodhount.Exploit &#8211; captalises on a couple of weaknesses in Adobe Acrobat and IE<br />
*Trojan:Win32/Opachki.A &#8211; is a trojan that runs at Windows start and redirects search queries while monitoring user Internet traffic<br />
*Nsrbgxod.bak &#8211; trojan.agent (above) which seems to be a rootkit infection</p>
<p>Please note that most Antivirus will not pickup malware or spyware very well, but i find if you have a combination at lease two different spyware scanners and a good antivirus program that is regulary updated you should be pretty safe. </p>
<p>As always check you patch level, i suggest you download the latest &#039;Microsoft Baseline Security Analyzer&#039; from the microsoft website.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: admin</title>
		<link>http://htlogs.com/what-is-ntuser-dll-how-to-remove-ntuser-dll/#comment-1893</link>
		<dc:creator>admin</dc:creator>
		<pubDate>Sun, 22 Nov 2009 05:00:51 +0000</pubDate>
		<guid isPermaLink="false">http://htlogs.com/?p=918#comment-1893</guid>
		<description>John, you mean ntuser.dat ?
ntuser.dll is not ntuser.dat</description>
		<content:encoded><![CDATA[<p>John, you mean ntuser.dat ?<br />
ntuser.dll is not ntuser.dat</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: John</title>
		<link>http://htlogs.com/what-is-ntuser-dll-how-to-remove-ntuser-dll/#comment-1857</link>
		<dc:creator>John</dc:creator>
		<pubDate>Sat, 21 Nov 2009 22:22:45 +0000</pubDate>
		<guid isPermaLink="false">http://htlogs.com/?p=918#comment-1857</guid>
		<description>ntuser.dll is related to the user accounts</description>
		<content:encoded><![CDATA[<p>ntuser.dll is related to the user accounts</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: admin</title>
		<link>http://htlogs.com/what-is-ntuser-dll-how-to-remove-ntuser-dll/#comment-1455</link>
		<dc:creator>admin</dc:creator>
		<pubDate>Mon, 09 Nov 2009 04:47:20 +0000</pubDate>
		<guid isPermaLink="false">http://htlogs.com/?p=918#comment-1455</guid>
		<description>Boot your computer in the Safe mode with networking by:
    * Restart your computer
    * After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
    * Instead of Windows loading as normal, a menu should appear
    * Select the second option, to run Windows in Safe Mode with networking

In the mode try open links above.</description>
		<content:encoded><![CDATA[<p>Boot your computer in the Safe mode with networking by:<br />
    * Restart your computer<br />
    * After hearing your computer beep once during startup, but before the Windows icon appears, press F8.<br />
    * Instead of Windows loading as normal, a menu should appear<br />
    * Select the second option, to run Windows in Safe Mode with networking</p>
<p>In the mode try open links above.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Juergen</title>
		<link>http://htlogs.com/what-is-ntuser-dll-how-to-remove-ntuser-dll/#comment-1454</link>
		<dc:creator>Juergen</dc:creator>
		<pubDate>Mon, 09 Nov 2009 03:51:23 +0000</pubDate>
		<guid isPermaLink="false">http://htlogs.com/?p=918#comment-1454</guid>
		<description>Cannot link to those hotlinks because it will reroute me to thefeedwater.com/... or providefeed.com...</description>
		<content:encoded><![CDATA[<p>Cannot link to those hotlinks because it will reroute me to thefeedwater.com/&#8230; or providefeed.com&#8230;</p>
]]></content:encoded>
	</item>
</channel>
</rss>

