Can't Load Some Pages On Ie7 And Yahoo Messenger Doesn't Work

cali_dude777 · June 4, 2007

I dont get what your suggestion is..

the only anti-virus i have on my computer is AVG.

jurgenv · June 4, 2007

So what is that Trend Micro doing over there? :wacko:

cali_dude777 · June 4, 2007

I don't know what Trend Micro is..

as far as i know i only installed AVG.

jurgenv · June 4, 2007

You have trend micro Internet security, that's Firewall, antivirus protection in one program, so I recommend you uninstall Trend micro or AVG.

cali_dude777 · June 4, 2007

I didn't even know i had this Trend Micro, never seen what it looks like...so I uninstalled it.

jurgenv · June 4, 2007

Ok, rerun ATF cleaner and reboot your system, after that, tell me how everything is working.

cali_dude777 · June 4, 2007

the problems are still there.

doesnt these entries on the hijackthis log look suspicous?

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

below is the new hijackthis log file

Logfile of HijackThis v1.99.1

Scan saved at 14:31:02, on 4/6/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\VTTimer.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe

C:\Arquivos de programas\Java\jre1.6.0_01\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\RAFAEL\Desktop\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ig.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\gbieh.dll

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Arquivos de programas\ICQToolbar\toolbaru.dll/SEARCH.HTML

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Arquivos de programas\AIM\aim.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O11 - Options group: [TABS] Tabbed Browsing

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/...utocomplete.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399F83} (GbPluginObj Class) - https://www14.bancobrasil.com.br/plugin/GbPluginBb.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\Arquivos de programas\GbPlugin\GbpSv.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe

jurgenv · June 4, 2007

No they aren't.

* Run the Panda online virus scan at http://www.pandasoftware.com/products/activescan.htm

- Once you are on the Panda site click the Scan your PC button

- A new window will open...click the Check Now button

- Enter your Country

- Enter your State/Province

- Enter your e-mail address and click send

- Select either Home User or Company

- Click the big Scan Now button

- If it wants to install an ActiveX component allow it

- It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)

- When download is complete, click on Local Disks to start the scan

- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location and post it here.

cali_dude777 · June 4, 2007

I tried to run the scan and it gave me this error message:

We're sorry. ActiveScan requires the browser Microsoft Internet Explorer 5.0 or later version.

doesn't Internet explorer 7.0 support the scan?

cali_dude777 · June 4, 2007

nevermind!

i was trying to run the scan on mozilla firefox.

it works now on internet explorer.

cali_dude777 · June 5, 2007

Incident Status Location

Spyware:Spyware/BetterInet Not disinfected C:\Arquivos de programas\Common files\updater\data1.dat

Spyware:Spyware/BetterInet Not disinfected C:\Arquivos de programas\Common files\updater\data2.dat

Virus:Trj/Banker.FNM Disinfected C:\Documents and Settings\All Users\Dados de aplicativos\SecTaskMan\ExCorp.exe.q_5949408A_q

Virus:Trj/Banker.FNM Disinfected C:\Documents and Settings\All Users\Dados de aplicativos\SecTaskMan\ExCorp.exe.q_804408A_q

Virus:Trj/Banker.FNM Disinfected C:\Documents and Settings\All Users\Dados de aplicativos\SecTaskMan\fatt32.src.q_804408A_q

Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\LOURDES\ConfiguraÃ§Ãµes locais\Dados de aplicativos\Mozilla\Firefox\Profiles\cupgxubr.default\Cache\DD0DBD66d01[C:\Documents and Settings\LOURDES\Configura+Âº+Â¦es locais\Dados de aplicativos\Mozilla\Firefox\Profiles\cupgxubr.default\Cac

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\LOURDES\Dados de aplicativos\Mozilla\Firefox\Profiles\cupgxubr.default\cookies.txt[.ig.com.br/]

Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\LOURDES\Desktop\SDFix.exe[sDFix\apps\Process.exe]

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\RAFAEL\Cookies\[email protected][1].txt

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\RAFAEL\Dados de aplicativos\Mozilla\Firefox\Profiles\fucefjlm.default\cookies.txt[.uol.com.br/]

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\RAFAEL\Dados de aplicativos\Mozilla\Firefox\Profiles\fucefjlm.default\cookies.txt[de.uol.com.br/]

Adware:adware/tvmedia Not disinfected C:\Documents and Settings\RAFAEL\Dados de aplicativos\tvmuknwrd.dll

Adware:Adware/AzeSearch Not disinfected C:\Documents and Settings\RAFAEL\Desktop\HijackThis\backups\backup-20070601-170153-576.inf

Potentially unwanted tool:Application/FunWeb Not disinfected C:\Documents and Settings\RAFAEL\Desktop\HijackThis\backups\backup-20070601-170153-739.inf

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\RAFAEL\Desktop\Rafael's Documents\Videos\ComboFix(2).exe[ComboFixT\nircmd.exe]

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\RAFAEL\Desktop\Rafael's Documents\Videos\ComboFix.exe[ComboFixT\nircmd.exe]

Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\RAFAEL\DoctorWeb\Quarantine\Process.exe

Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\RAFAEL\DoctorWeb\Quarantine\process0.exe

Potentially unwanted tool:Application/Processor Not disinfected C:\SDFix\apps\Process.exe

Adware:adware/sahagent Not disinfected C:\WINDOWS\Downloaded Program Files\sporder_.dll

Adware:Adware/IST.YourSiteBar Not disinfected C:\WINDOWS\Downloaded Program Files\ysbactivex.inf

Adware:Adware/IPInsight Not disinfected C:\WINDOWS\inf\conscorr.inf

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\nircmd.exe

Adware:Adware/SAHAgent Not disinfected C:\WINDOWS\system32\xmltok.dll

Dialer:dialer.baj Not disinfected C:\x.cab

cali_dude777 · June 6, 2007

any suggestions??

thank you

jurgenv · June 7, 2007

* Download OTMoveIt.exe from here and place it on your desktop:

http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

* Open OTMoveIt.exe.

In the left pane where it says: "Paste List of Files/Folders to be Moved", copy and paste next part:

C:\WINDOWS\Downloaded Program Files\sporder_.dll

C:\WINDOWS\Downloaded Program Files\ysbactivex.inf

C:\WINDOWS\inf\conscorr.inf

C:\WINDOWS\system32\xmltok.dll

C:\x.cab

C:\Arquivos de programas\Common files\updater\data1.dat

C:\Arquivos de programas\Common files\updater\data2.dat

Then click the MoveIt button below.

In case you get a "Bad Image" error, just click OK at the promt. It will move the file anyway.

When done, it will create a log (********_******.log -- * stands for date and time) in next folder: C:\_OTMoveIt\MovedFiles.

Copy and paste this log in your next reply with a new hijackthis log.

cali_dude777 · June 7, 2007

thanks for the reply. below is the otmoveit log and hijackthis log.

File/Folder C:\WINDOWS\Downloaded Program Files\sporder_.dll not found.

C:\WINDOWS\Downloaded Program Files\ysbactivex.inf moved successfully.

C:\WINDOWS\inf\conscorr.inf moved successfully.

DllUnregisterServer procedure not found in C:\WINDOWS\system32\xmltok.dll

C:\WINDOWS\system32\xmltok.dll NOT unregistered.

C:\WINDOWS\system32\xmltok.dll moved successfully.

C:\x.cab moved successfully.

File/Folder C:\Arquivos de programas\Common files\updater\data1.dat not found.

File/Folder C:\Arquivos de programas\Common files\updater\data2.dat not found.

Created on 06/07/2007 15:44:15

Logfile of HijackThis v1.99.1

Scan saved at 15:46:35, on 7/6/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\VTTimer.exe

C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe

C:\Arquivos de programas\Java\jre1.6.0_01\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Documents and Settings\RAFAEL\Desktop\Protection\OTMoveIt.exe

C:\WINDOWS\notepad.exe

C:\Documents and Settings\RAFAEL\Desktop\Protection\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ig.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\gbieh.dll

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.6.0_01\bin\jusched.exe