Help with facebook [Archive] - Safer-Networking Forums

Inigo Montoya

2008-04-08, 14:06

Ok, so for some reason firefox wont open facebook. It just keeps on loading the page. All other pages load normaly. I tried turning of nod32 to see if it may be blocking it, but it still won't load.

please help

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:59:43, on 08.04.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
d:\Mscvn4w2002\Flexlm\i386\LMGRD.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\system32\nvsvc32.exe
d:\Mscvn4w2002\Flexlm\i386\esplmd.exe
C:\WINNT\system32\PnkBstrA.exe
C:\WINNT\system32\svchost.exe
d:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
D:\ABAQUS\Documentation\monitor.exe
D:\ABAQUS\Documentation\monitor.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wscntfy.exe
C:\WINNT\SYSTEM32\starter.exe
C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
D:\program files\Qtime\qttask.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
D:\Program Files\Winamp\winampa.exe
D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\Rundll32.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
D:\Program Files\ScanWizard 5\ScannerFinder.exe
D:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
D:\Program Files\WinZip\WZQKPICK.EXE
D:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\ismojver\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: (no name) - {01CD0B31-9154-45F2-9414-F5D64B74EAF6} - C:\WINNT\system32\tuvwvww.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE Class - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: (no name) - {4D095168-2B61-4ABF-87D0-2FCC082B4099} - C:\WINNT\system32\mljji.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: {572f136a-919c-9a69-a204-9717d9d95298} - {89259d9d-7179-402a-96a9-c919a631f275} - C:\WINNT\system32\iacyceir.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [EnsoniqMixer] C:\WINNT\SYSTEM32\starter.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\program files\Qtime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [WinampAgent] d:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [egui] "D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [a8f4ed4b] rundll32.exe "C:\WINNT\system32\qvflmmox.dll",b
O4 - HKLM\..\Run: [BMabc7ded7] Rundll32.exe "C:\WINNT\system32\pwqisofg.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = D:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Scanner Finder.lnk = D:\Program Files\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = D:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\winnt\system32\nwprovau.dll
O20 - Winlogon Notify: tuvwvww - tuvwvww.dll (file missing)
O20 - Winlogon Notify: vtuspmk - C:\WINNT\
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINNT\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINNT\system32\browseui.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: DomainService - Unknown owner - C:\WINNT\system32\wahgfgwt.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - D:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXlm License Server - GLOBEtrotter Software Inc. - d:\Mscvn4w2002\Flexlm\i386\LMGRD.EXE
O23 - Service: FLEXlm Service 1 - Macrovision Corporation - d:\abaqus\license\lmgrd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: gzg8wud2rcccs - Unknown owner - C:\WINNT\system32\systs.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINNT\system32\PnkBstrA.exe
O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc - d:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - d:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
O23 - Service: Texis Monitor - Expansion Programs International, Inc. - D:\ABAQUS\Documentation\monitor.exe

Blade81

2008-04-08, 22:14

Hi

Turn Nod32 off before starting ComboFix.

1. Download combofix from any of these links and save it to Desktop:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)

**Note: It is important that it is saved directly to your desktop**

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you (C:\ComboFix.txt). Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

If you have problems with Combofix usage, see here (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)

Inigo Montoya

2008-04-09, 14:01

Here is the log:

ComboFix 08-04-08.9 - ismojver 2008-04-09 12:49:38.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.161 [GMT 2:00]
Running from: C:\Documents and Settings\ismojver\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
C:\WINNT\BMabc7ded7.xml
C:\WINNT\cookies.ini
C:\WINNT\pskt.ini
C:\WINNT\system32\aawyiayu.dll
C:\WINNT\system32\acydvryb.dll
C:\WINNT\system32\aqddinea.dll
C:\WINNT\system32\aqsfvimw.ini
C:\WINNT\system32\ayqldgjx.dll
C:\WINNT\system32\bcamiisg.dll
C:\WINNT\system32\brydcbsw.ini
C:\WINNT\system32\bucshgrp.dll
C:\WINNT\system32\dnfqjqmk.dll
C:\WINNT\system32\dphslqav.ini
C:\WINNT\system32\emltyhxv.ini
C:\WINNT\system32\emtpgign.dll
C:\WINNT\system32\eplcenaa.ini
C:\WINNT\system32\equsdgdi.dll
C:\WINNT\system32\gsiimacb.ini
C:\WINNT\system32\hfgxwrvd.dll
C:\WINNT\system32\hirkrnnv.ini
C:\WINNT\system32\hldpksuo.dll
C:\WINNT\system32\hlfqmuly.dll
C:\WINNT\system32\howbvigt.ini
C:\WINNT\system32\hpfwuful.ini
C:\WINNT\system32\hqaxwnbr.dll
C:\WINNT\system32\hucvjfwb.ini
C:\WINNT\system32\iacyceir.dll
C:\WINNT\system32\icuxuwbs.dll
C:\WINNT\system32\iigyfwyu.ini
C:\WINNT\system32\iinwjqhr.ini
C:\WINNT\system32\iyvhptjq.ini
C:\WINNT\system32\jfhtbipf.dll
C:\WINNT\system32\jhefqacl.ini
C:\WINNT\system32\jlorbusp.ini
C:\WINNT\system32\jmllm.bak1
C:\WINNT\system32\jmllm.ini
C:\WINNT\system32\jtewmubk.dll
C:\WINNT\system32\jtmhhsks.dll
C:\WINNT\system32\jtrxxbfn.ini
C:\WINNT\system32\kfguacfh.ini
C:\WINNT\system32\kkjrlrwq.ini
C:\WINNT\system32\kmqjqfnd.ini
C:\WINNT\system32\kofgxxct.dll
C:\WINNT\system32\lavuyytl.dll
C:\WINNT\system32\lcaqfehj.dll
C:\WINNT\system32\lpskaqnh.dll
C:\WINNT\system32\ltyyuval.ini
C:\WINNT\system32\mcrh.tmp
C:\WINNT\system32\mllmj.dll
C:\WINNT\system32\ndsftenj.dll
C:\WINNT\system32\nfbxxrtj.dll
C:\WINNT\system32\ngfbtgiy.dll
C:\WINNT\system32\nnkscuhw.dll
C:\WINNT\system32\nqstv.bak1
C:\WINNT\system32\nqstv.bak2
C:\WINNT\system32\nqstv.ini
C:\WINNT\system32\onnmp.bak1
C:\WINNT\system32\onnmp.ini
C:\WINNT\system32\oskehygx.dll
C:\WINNT\system32\oupfbqxl.ini
C:\WINNT\system32\pmnno.dll
C:\WINNT\system32\pnpjcdox.dll
C:\WINNT\system32\pnqwnjco.dll
C:\WINNT\system32\pqfxydby.dll
C:\WINNT\system32\psubrolj.dll
C:\WINNT\system32\pwqisofg.dll
C:\WINNT\system32\qeatpppc.dll
C:\WINNT\system32\qjtphvyi.dll
C:\WINNT\system32\qvflmmox.dll
C:\WINNT\system32\qwrlrjkk.dll
C:\WINNT\system32\rlegooky.ini
C:\WINNT\system32\rqhbdeyj.ini
C:\WINNT\system32\rqtss.bak1
C:\WINNT\system32\rqtss.bak2
C:\WINNT\system32\rqtss.ini
C:\WINNT\system32\rqtss.ini2
C:\WINNT\system32\rqtss.tmp
C:\WINNT\system32\shodhxlm.dll
C:\WINNT\system32\sstqr.dll
C:\WINNT\system32\tgrevwji.ini
C:\WINNT\system32\tsiyiscb.dll
C:\WINNT\system32\ubrccxfy.ini
C:\WINNT\system32\uxyytiud.dll
C:\WINNT\system32\vdjpfqyq.dll
C:\WINNT\system32\vnnrkrih.dll
C:\WINNT\system32\vxhytlme.dll
C:\WINNT\system32\wdaewexs.ini
C:\WINNT\system32\whucsknn.ini
C:\WINNT\system32\wqybdjqs.dll
C:\WINNT\system32\wsbcdyrb.dll
C:\WINNT\system32\wxgctdkw.ini
C:\WINNT\system32\xairqedg.dll
C:\WINNT\system32\xkqbkgbq.ini
C:\WINNT\system32\xommlfvq.ini
C:\WINNT\system32\yblaldvs.dll
C:\WINNT\system32\yjiixgru.dll
C:\WINNT\system32\ytvspbeh.dll
C:\WINNT\system32\yugvgbqc.dll
C:\WINNT\Web\default.htt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DOMAINSERVICE
-------\Legacy_GZG8WUD2RCCCS
-------\Service_DomainService
-------\Service_gzg8wud2rcccs

((((((((((((((((((((((((( Files Created from 2008-03-09 to 2008-04-09 )))))))))))))))))))))))))))))))
.

2008-03-30 17:21 . 2008-02-22 02:33 69,632 --a------ C:\WINNT\system32\javacpl.cpl
2008-03-13 00:56 . 2008-03-13 00:56 127 --a------ C:\WINNT\system32\MRT.INI
2008-03-11 00:08 . 2008-03-12 00:07 1,315,170 ---hs---- C:\WINNT\system32\polcuryb.ini
2008-03-09 22:14 . 2008-03-10 00:02 1,307,621 ---hs---- C:\WINNT\system32\cbtkoinn.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-05 21:05 22,328 ----a-w C:\WINNT\system32\drivers\PnkBstrK.sys
2008-04-05 16:39 --------- d-----w C:\Documents and Settings\ismojver\Application Data\uTorrent
2008-03-30 15:21 --------- d-----w C:\Program Files\Java
2008-03-09 09:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-07 10:20 --------- d-----w C:\Program Files\The Weather Channel FW
2008-03-06 20:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-03 18:55 --------- d-----w C:\Program Files\MessengerDiscovery
2008-02-29 02:07 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-02-29 02:03 --------- d-----w C:\Program Files\Windows Live
2008-02-28 11:04 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-02-28 11:01 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-02-28 10:59 --------- d-----w C:\Program Files\Windows Live Favorites
2008-02-28 10:50 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-28 10:47 --------- d-----w C:\Program Files\MSN Messenger
2008-02-26 08:37 --------- d-----w C:\Program Files\Enigma Software Group
2008-02-17 20:19 87,040 ----a-w C:\WINNT\e01.exe
2008-02-17 20:19 23,040 ----a-w C:\info.exe
2008-02-17 20:19 22,608 ----a-w C:\WINNT\e00.exe
2008-02-01 10:11 586,240 ----a-w C:\WINNT\WLXPGSS.SCR
2007-11-30 14:13 347 ----a-w C:\Program Files\INSTALL.LOG
2006-01-10 16:26 271 --sh--w C:\Program Files\desktop.ini
2006-01-10 16:26 21,952 -c-ha-w C:\Program Files\folder.htt
2003-12-18 10:33 20,102 ----a-w C:\Program Files\Readme.txt
2003-09-03 06:46 10,960 ----a-w C:\Program Files\EULA.txt
2007-11-13 22:05 6,473 --sh--w C:\WINNT\system32\ijjlm.bak1
2008-01-07 18:29 91,175 --sh--w C:\WINNT\system32\ijjlm.bak2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4D095168-2B61-4ABF-87D0-2FCC082B4099}]
C:\WINNT\system32\mljji.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINNT\system32\ctfmon.exe" [2004-08-04 01:56 15360]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-01-01 19:57 40960]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-13 17:00 68856]
"DW4"="C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" [2007-12-20 09:10 715888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [2004-08-04 01:56 143360 C:\WINNT\system32\mobsync.exe]
"EnsoniqMixer"="C:\WINNT\SYSTEM32\starter.exe" [2000-08-10 13:58 32768]
"HPDJ Taskbar Utility"="C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-15 19:00 196608]
"POINTER"="point32.exe" []
"Acrobat Assistant 7.0"="D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 13:12 483328]
"NvCplDaemon"="C:\WINNT\system32\NvCpl.dll" [2005-12-10 04:06 7311360]
"nwiz"="nwiz.exe" [2005-12-10 04:06 1519616 C:\WINNT\system32\nwiz.exe]
"NvMediaCenter"="C:\WINNT\system32\NvMcTray.dll" [2005-12-10 04:06 86016]
"NeroFilterCheck"="C:\WINNT\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"QuickTime Task"="D:\program files\Qtime\qttask.exe" [2006-02-23 20:01 98304]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-01-01 19:57 40960]
"WinampAgent"="d:\Program Files\Winamp\winampa.exe" [2003-12-13 02:50 33792]
"NWEReboot"="" []
"egui"="D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 09:21 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [1999-12-07 14:00 20752 C:\WINNT\system32\internat.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [2004-08-04 01:56 214528]
"tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-03 23:59 44544]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINNT\Installer\{AC76BA86-1033-787C-7760-100000000002}\SC_Acrobat.exe [2006-01-11 21:25:34 25214]
Adobe Reader Speed Launch.lnk - D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-10 11:48:42 10872]
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 12:01:04 83360]
Scanner Finder.lnk - D:\Program Files\ScanWizard 5\ScannerFinder.exe [2006-05-05 17:57:49 315392]
Ulead Photo Express 4.0 SE Calendar Checker .lnk - D:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2006-05-03 23:21:30 69632]
WinZip Quick Pick.lnk - D:\Program Files\WinZip\WZQKPICK.EXE [2006-01-11 21:38:13 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvwvww]
tuvwvww.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtuspmk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Program Files\\igre\\Wolfenstein - Enemy Territory\\ET.exe"=
"C:\\StubInstaller.exe"=
"D:\\Program Files\\LimeWire\\LimeWire.exe"=
"D:\\Program Files\\WS_FTP\\WS_FTP95.exe"=
"D:\\ABAQUS\\License\\lmgrd.exe"=
"D:\\ABAQUS\\6.5-1\\cae\\exec\\ABQcaeK.exe"=
"D:\\ABAQUS\\6.5-1\\cae\\exec\\ABQvwrK.exe"=
"D:\\Program Files\\mIRC\\mirc.exe"=
"D:\\Mscvn4w2002\\Flexlm\\i386\\esplmd.exe"=
"D:\\Mscvn4w2002\\Flexlm\\i386\\lmgrd.exe"=
"D:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\WINNT\\system32\\rtcshare.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\WINNT\\PCHEALTH\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\Mathematica.exe"=
"D:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\MathKernel.exe"=
"D:\\Program Files\\Wolfram Research\\Mathematica\\6.0\\math.exe"=
"E:\\VLADIMIR\\Dungeon Siege 2\\DungeonSiege2.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"D:\\Program Files\\aMSN\\bin\\wish.exe"=

R1 epfwtdir;epfwtdir;C:\WINNT\system32\DRIVERS\epfwtdir.sys [2007-12-21 09:21]
R2 FLEXlm License Server;FLEXlm License Server;d:\Mscvn4w2002\Flexlm\i386\LMGRD.EXE [2001-11-19 15:31]
R2 SweepNet;Sophos Anti-Virus Network;"d:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE" [2005-09-09 19:55]
R2 Texis Monitor;Texis Monitor;D:\ABAQUS\Documentation\monitor.exe [2003-04-29 21:02]
S3 AEXPAM;Philips SmartManage Service;C:\WINNT\system32\Drivers\aexpamdrv.sys [2004-09-01 15:10]
S3 FLEXlm Service 1;FLEXlm Service 1;d:\abaqus\license\lmgrd.exe [2003-07-08 16:20]
S3 GR433S;GR433S;C:\WINNT\system32\Drivers\GR433s.sys [2003-11-07 11:22]
S3 InterCheck Control;InterCheck Control;d:\Program Files\Sophos SWEEP for NT\icntdrv5.sys [2005-08-05 13:23]
S3 InterCheck Filter;InterCheck Filter;d:\Program Files\Sophos SWEEP for NT\icntflt5.sys [2005-08-05 13:23]
S3 InterCheck Support 01;InterCheck Support 01;d:\Program Files\Sophos SWEEP for NT\icntst01.sys [2005-08-05 13:23]
S3 InterCheck Support 02;InterCheck Support 02;d:\Program Files\Sophos SWEEP for NT\icntst02.sys [2005-08-05 13:23]
S3 InterCheck Support 03;InterCheck Support 03;d:\Program Files\Sophos SWEEP for NT\icntst03.sys [2005-08-05 13:23]
S3 InterCheck Support 04;InterCheck Support 04;d:\Program Files\Sophos SWEEP for NT\icntst04.sys [2005-08-05 13:23]
S3 InterCheck Support 05;InterCheck Support 05;d:\Program Files\Sophos SWEEP for NT\icntst05.sys [2005-08-05 13:23]
S3 InterCheck Support 06;InterCheck Support 06;d:\Program Files\Sophos SWEEP for NT\icntst06.sys [2005-08-05 13:23]
S3 InterCheck Support 07;InterCheck Support 07;d:\Program Files\Sophos SWEEP for NT\icntst07.sys [2005-08-05 13:23]
S3 InterCheck Support 08;InterCheck Support 08;d:\Program Files\Sophos SWEEP for NT\icntst08.sys [2005-08-05 13:23]
S3 InterCheck Support 09;InterCheck Support 09;d:\Program Files\Sophos SWEEP for NT\icntst09.sys [2005-08-05 13:23]
S3 InterCheck Support 10;InterCheck Support 10;d:\Program Files\Sophos SWEEP for NT\icntst10.sys [2005-08-05 13:23]
S3 InterCheck Support 11;InterCheck Support 11;d:\Program Files\Sophos SWEEP for NT\icntst11.sys [2005-08-05 13:23]
S3 InterCheck Support 12;InterCheck Support 12;d:\Program Files\Sophos SWEEP for NT\icntst12.sys [2005-08-05 13:23]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service;"C:\Program Files\Windows Live\Messenger\usnsvc.exe" [2007-10-18 12:31]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{868f5884-0856-11db-9344-0050bfd60683}]
\Shell\AutoRun\command - I:\autoplay.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-04-09 00:29:00 C:\WINNT\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-09 12:54:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINNT\System32\SCardSvr.exe
D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\system32\nvsvc32.exe
d:\Mscvn4w2002\Flexlm\i386\esplmd.exe
C:\WINNT\system32\PnkBstrA.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\AcroDist.exe
D:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\WINNT\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-04-09 12:57:44 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-09 10:57:25
Pre-Run: 15,411,871,744 bytes free
Post-Run: 15,275,438,080 bytes free
.
2008-03-12 22:58:08 --- E O F ---

Thx a lot, i can load facebook now.
Great job you all are doing here.

If its not to much trouble, would you mind explaining why it wouldn't load?

Anyway, cheers!

Blade81

2008-04-09, 16:07

Thx a lot, i can load facebook now.
Great job you all are doing here.

If its not to much trouble, would you mind explaining why it wouldn't load?

Hi

You had (and still have some parts left) Vundo infection which was likely behind the problem. Let's continue cleaning the remnants.

Upload following files to http://virusscan.jotti.org and post back the results:
C:\WINNT\e01.exe
C:\info.exe
C:\WINNT\e00.exe

Start hjt, do a system scan, check:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

Close browsers and other windows. Click fix checked.

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINNT\system32\polcuryb.ini
C:\WINNT\system32\cbtkoinn.ini
C:\WINNT\system32\ijjlm.bak1
C:\WINNT\system32\ijjlm.bak2

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4D095168-2B61-4ABF-87D0-2FCC082B4099}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvwvww]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtuspmk]

Save this as
CFScript

http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

Please run an online scan with Kaspersky Online Scanner (http://www.kaspersky.com/downloads/kws/kavwebscan.html). You will be prompted to install an ActiveX component from Kaspersky, click Yes.
The program will launch and start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings and select the following:
Scan using the following Anti-Virus database:
Extended (If available, otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK.
Under
select a target to scan
, select My Computer.
The scan will take a while so be patient and let it run. As it scans your machine very deeply it could take hours to complete, Kaspersky suggests running it during a time of low activity.Once the scan is complete:
Click on the Save as Text button.
Save the file to your desktop.
Copy and paste that information into your next post if the AV content will fit into one post only. Post a fresh hjt log too.

Note for Internet Explorer 7 users: If at any time you have trouble with the Accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.

If having a problme doing the above

Make sure that your Internet security settings are set to default values.

To set default security settings for Internet Explorer:

* Open Internet Explorer.
* Go to the Tools menu, then choose Internet Options.
* Click on the Security tab.
* Make sure that all four item (Internet, Local intranet, Trusted sites, and Restricted sites) are set to their default settings.

Blade81

2008-04-16, 21:02

Due to inactivity, this thread will now be closed.

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.