Chrome has internet access, malware is blocking IE and FF

[sammywhammo]

The symptoms are pretty much what I said in the thread title, Firefox opens, but webpages won't load. Chrome has full internet. What heppened was I navigated to a page firefox said had security issues, but then got popup message spammed, saying to download security exceptions, which I clicked cancel to, but it downloaded something anyway, and an error popped up saying something about a javascript failing to run. I panicked, ctrl alt del and shut down firefox. Now, no internet in FF or IE. I've tried installing malwarebytes and godzillakiller, a combo someone else said worked for a similar problem, and also installed nod 32 and did a scan which didn't fix jack either. Please, oh internet saviors save my laptop. I have &^(*& i need to do!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:05:46 AM, on 10/20/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Users\Sam\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
C:\Program Files\Digsby\lib\digsby-app.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Program Files\Malwarebytes' Anti-Malware\xxxx.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Logitech\LWS\LU\LULnchr.exe
C:\Program Files\Logitech\LWS\LU\LogitechUpdate.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\cmd.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Sam\Downloads\HijackThis.exe
C:\Program Files\Google\Chrome\Application\chrome.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Freecause Shopping BHO - {998A3C0C-8914-4D2A-AE36-BFA2E5AE6D5D} - C:\Program Files\Digsby Donates\ShoppingBHO.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Users\Sam\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
O4 - Startup: Digsby.lnk = C:\Program Files\Digsby\digsby.exe
O4 - Startup: JDownloader.exe.lnk = Sam\Downloads\JDownloader 0.8.9\JDownloader.exe
O4 - Startup: RivaTuner.lnk = C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTunerWrapper.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Google Update Service (gupdate1ca9f7463c53bfc) (gupdate1ca9f7463c53bfc) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 6122 bytes

[tequesta]

Hello sammywhammo,


Hello,

My name is John, AKA Tequesta, and I will be assisting you with your malware issues.
Please be patient, as I need some time to review your Hijackthis log, and all of my responses are reviewed by a MRU Teacher. Once approved, I will post the recommendations for repairs.

• Whatever repairs we make, are for your computer problems only, and by no means should they be used on another computer.
• Continue to respond to this thread until I give you the All Clean! If you have any question, or do not understand my instructions, STOP, and reply back to me. I will try my best to help you!
• Please bookmark or favorite this page, so you can return or use it as a reference easily.

While you wait please take time to read the Malware Removal Forum Guidelines and Rules where the conditions for receiving help at this forum are explained.


First please refrain from using profanity of any kind on this forum. Please edit your post accordingly.

Next:

Uninstall Manager

• Start HijackThis
• Click on the Open the Misc Tools box
• Click on the Open Uninstall Manager box
• Click on the Save List box
• Save to your desk top or some place you can find later.
• Notepad will open with an uninstall list. Copy and paste it into your next post.
• If notepad does not popup, navigate to were you saved the file and retrieve the list.

Please post
Any changes with your machine and
the uninstall list.

thank you,

John

[sammywhammo]

32 Bit HP CIO Components Installer
Abe's Oddysee
abgx360 v1.0.2
Acrobat.com
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.3
Adobe Shockwave Player 11.5
Apple Application Support
Apple Software Update
Battle for Wesnoth 1.7.12-1.8beta5
CameraHelperMsi
CDisplay 1.8
CloneCD
Combined Community Codec Pack 2009-09-09
Conexant HD Audio
CoreAVC Professional Edition (remove only)
Digsby
Digsby Donates
DivX Web Player
Electricsheep Screensaver 2.7b19
erLT
Google Chrome
Google Update Helper
GTK+ Runtime 2.14.7 rev a (remove only)
HDAUDIO Soft Data Fax Modem with SmartCP
HP Photosmart C309a All-In-One Driver 13.0 Rel .5
Java(TM) 6 Update 13
Lame ACM MP3 Codec
Logitech Webcam Software
LWS Facebook
LWS Gallery
LWS Help_main
LWS Launcher
LWS Motion Detection
LWS Pictures And Video
LWS Video Mask Maker
LWS VideoEffects
LWS Webcam Software
LWS WLM Plugin
LWS YouTube Plugin
Machinarium
Malwarebytes' Anti-Malware
Marvel Vs
MediaMonkey 3.2
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Client Profile
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Groove MUI (English) 2010
Microsoft Office InfoPath MUI (English) 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2010
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.6.11)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NVIDIA Drivers
OpenAL
Philips PC Camera
Pidgin
Skype Toolbars
Skype™ 4.2
Solium Infernum
SopCast 3.2.4
StarCraft II
Steam
Synaptics Pointing Device Driver
VC80CRTRedist - 8.0.50727.762
VirtualCloneDrive
VLC media player 1.0.1
Warcraft III
WC3Banlist
Winamp
WinPcap 4.1.1
WinRAR archiver

[tequesta]

Hello sammywhammo,

Please remember that all the tools we use need to be run in the administrator mode, just right click on the program and choose "Run As Administrator."

RSIT (Random's System Information Tool)
Please download RSIT by random/random... save it to your desktop.

1. Right click on RSIT.exe and select "Run As Administrator" to run it. If Windows UAC prompts you, please allow it.
2. Please read the disclaimer... click on Continue.
3. RSIT will start running. When done... 2 logs files...will be produced.
   The first one, "log.txt", <<will be maximized... the second one, "info.txt", <<will be minimized.
4. Please post both... "log.txt" and "info.txt", file contents in your next reply.

(These logs can be lengthy, so post 1 log per reply please.)

Next:

GMER
The downloaded file will have a random name... this prevents malware from detecting and blocking it.
Please download GMER... random file name.exe by GMER. An alternate (zip file) download site.
Note: Do not run any programs while Gmer is running.
**Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

1. Right click on the random named.exe and select run as an administrator, to execute. If asked, allow the gmer.sys driver load.
   If using Vista or Win 7, you must right click random named.exe and choose "Run As Administrator".
2. If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO <--- Important!
3. On the right side panel, several boxes have been checked. Please UNCHECK the following: (see image below)
   
   • IAT/EAT
   • Drives/Partition other than Systemdrive (typically C:\)
   • Show All <-- don't miss this one
   
   
   Click on image to enlarge
   
   
4. If you don't get a warning then... Click the Rootkit/Malware tab at the top of the GMER window.
5. Click the Scan button.
6. Once the scan has finished... click Save. The Save... window will open.
7. Save the scan results as gmerroot.log, save it to your Desktop.
8. Double click on the desktop "gmerroot.log" file, to open in Notepad.
9. Copy and paste the contents of the file gmerroot.log in your next reply.

Using AUTOSTART (replace last line of above, append to GMER instructions, if using)

In the GMER window...

• Click on the >>> tab at the top of the GMER window. This displays the rest of the "selection" tabs for you.
• Click on the Autostart tab... then click on Scan button.
• Once the scan has finished... click Save. The Save... window will open.
• Save the scan results as gmerauto.log, save it to your Desktop.
• Double click on the desktop "gmerauto.log" file, to open in Notepad.
• Copy and paste the contents of the files gmerroot.log and gmerauto.log in your next reply.

Would you please clarify, did you run Mbam successfully?


Please post:
Any changed with your machine
the answer to my question
Gmer log and the
Rsit logs.

Thank you,

John

[Wingman]

Due to a lack of response, this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.