Windows 2000 Server Exploring Problem

From what I`ve read,the cause is a rogue browser helper object (BHO)

The solution -

1. Click Start, Run, type or paste Control Inetcpl.cpl

2. Click the Advanced tab.

3. Under Browsing, click to uncheck the Enable third-party browser extensions (requires restart) check box.


The registry solution is HERE

Hi Po'girl.

I checked for that now, cause I did read something abou that elsewhere aswell, But there is no such option under browsing.
i tried the manual Removal of the services through the registry hack you supplied, that didnt work either.

I noticed that there is 3 entries under:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects\

I added the NoExlorer D_WORD to all three of them but when I reboot windows automatically removes the one.

Ok Update on that problem...
I cleared my System events and tried to run it.
There was 3 alerts created...
------------------------------------------

1: Winlogon : The shell stopped unexpectedly and Explorer.exe was restarted.

2: MsiInstaller : Detection of product '{AFD2C5B5-BF78-47B6-9569-755448C0D0EE}', feature 'OLEAUT32' failed during request for component '{997FA962-E067-11D1-9396-00A0C90F27F9}'

3: MsiInstaller : Detection of product '{AFD2C5B5-BF78-47B6-9569-755448C0D0EE}', feature 'OLEAUT32' failed during request for component '{997FA962-E067-11D1-9396-00A0C90F27F9}'

Any Ideas?

Hi guys.

Here is the HJT log file. please check if you see anything that doesnt belong here. thanks

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:29:58 , on 01/11/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\system32\cisvc.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\Program Files\Borland\INTRBASE\bin\ibguard.exe
C:\Program Files\Borland\INTRBASE\bin\ibserver.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\RsFsa.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ZebedeeVNC\zebedee.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\dns.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\RsSub.exe
C:\WINNT\System32\RsEng.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\cidaemon.exe
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\system32\cidaemon.exe
C:\WINNT\explorer.exe
C:\totalcmd\TOTALCMD.EXE
C:\WINNT\system32\taskmgr.exe
C:\I.T\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINNT\System32\jncjhtbn.dll",sitypnow
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2FF3E39-691C-4A61-91DD-CB5EF9D96746}: NameServer = 192.168.0.200
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Firebird Guardian (FirebirdGuardian) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Firebird Server (FirebirdServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: InterBase Guardian (InterBaseGuardian) - Inprise Corporation - C:\Program Files\Borland\INTRBASE\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Inprise Corporation - C:\Program Files\Borland\INTRBASE\bin\ibserver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Windows Internet Name Service (WINS) (WINS) - Unknown owner - C:\WINNT\System32\wins.exe (file missing)
O23 - Service: VNC Server (winvnc) - Constantin Kaplinsky - C:\Program Files\TightVNC\WinVNC.exe
O23 - Service: Zebedee VNC Server - Unknown owner - C:\Program Files\ZebedeeVNC\zebedee.exe

--
End of file - 3775 bytes

try pressing windows(button) +E on ur keyboard

Yeah. Please read the complete thread!
I cant do nothing. Cant browse.