Solved Trouble Getting Facebook to Load

CocoaBean99 · Oct 20, 2009

I have been having problems getting Facebook to load for a couple of weeks. The problem seems to be getting worse to the point where it will only load once every couple of days. I have tried downloading a new browser (was using ie8 now I'm using Firefox) and neither has made a difference.

When I click on Facebook from my yahoo toolbar, or type it in manually it will either say it can't open the page with a popup saying it wants to load a file (in IE) or it will just load a bunch of random wingding like code (in Firefox) all over the page.

I have tried running CC_Cleaner, and Malwarebytes' and ComboFix. None of these have worked. I've run multiple virus scans through Norton Internet Security as well and it hasn't come up with anything. Any help would be greatly appreciated!!!

Crush · Oct 20, 2009

Hi Cocobean and welcome to PCHF!

First, let's do a bit of housekeeping. Have a look at this thread and see if those steps solve your facebook issues

CocoaBean99 · Oct 20, 2009

Thanks for the welcome and the response.

I followed the link, and went ahead and deleted my temporary files, then ran a defrag on my hard drive and a scandisk for errors. My computer is fairly clean, it's not that old, and I try to use some canned air on it once a month.

Any other suggestions?

Crush · Oct 20, 2009

CocoaBean,

I missed the last part of your post on my first read through. What you did was quite risky. ComboFix should ONLY be run in the event you are working with a trained expert. Otherwise your PC could be rendered unbootable. Do you have the logs from your run through?

CocoaBean99 · Oct 21, 2009

Which logs do you want? I saved the log from my defrag, and I believe there should be a log from the malwarebytes, and Ccleaner. The Combofix just appears to want to run again when I click on it and I can't seem to find a log that it might have created.

I followed advice from another link on here to run Combofix...I had no idea it was so risky to run it! It was just from another thread where someone was having issues with Facebook. Perhaps that should be clarified. If I can find the thread again I will post you the link.

CocoaBean99 · Oct 21, 2009

http://www.pchelpforum.com/pending-hjt-logs/51861-vundo-trojan-cause-firefox-not-load-facebook.html

That's the link to the thread that led me to load and use ComboFix. I found the log by rereading that as well:

ComboFix 09-10-16.09 - Amy 10/17/2009 22:38.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1040 [GMT -4:00]
Running from: c:\documents and settings\Amy\Desktop\ComboFix.exe
AV: Norton Internet Security 2006 *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security 2006 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((( Files Created from 2009-09-18 to 2009-10-18 )))))))))))))))))))))))))))))))
.

2019-09-26 03:40 . 2009-02-15 20:44 311977 ----a-w- c:\windows\RAIN RAIN GO AWAY.SCR
2009-10-18 01:44 . 2009-10-18 01:44 -------- d-----w- c:\documents and settings\Amy\Application Data\Malwarebytes
2009-10-18 01:44 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-18 01:43 . 2009-10-18 01:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-18 01:43 . 2009-10-18 01:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-18 01:43 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-18 01:28 . 2009-10-18 01:28 -------- d-----w- c:\program files\CCleaner
2009-10-15 16:28 . 2009-10-15 16:28 -------- d-----w- c:\documents and settings\Amy\Application Data\Motive
2009-10-15 16:27 . 2009-10-15 16:28 -------- d-----w- c:\program files\Verizon
2009-10-15 16:24 . 2009-10-15 16:28 -------- d-----w- c:\program files\Common Files\Motive
2009-10-15 16:24 . 2009-10-15 16:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2009-10-13 13:42 . 2009-10-13 13:42 -------- d-----w- c:\documents and settings\Amy\Local Settings\Application Data\AIM
2009-10-09 15:01 . 2009-10-09 15:01 -------- d-----w- c:\documents and settings\Amy\Application Data\Trusteer
2009-10-09 15:01 . 2009-10-09 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Trusteer
2009-10-09 15:01 . 2009-10-09 15:01 -------- d-----w- c:\program files\Trusteer
2009-10-06 17:51 . 2009-10-06 17:51 578560 -c--a-w- c:\windows\system32\dllcache\user32.dll
2009-10-06 17:48 . 2009-10-06 17:48 -------- d-----w- c:\windows\ERUNT
2009-10-06 17:41 . 2009-10-06 17:41 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-10-06 17:23 . 2009-10-06 18:07 -------- d-----w- C:\SDFix
2009-10-02 19:33 . 2009-10-02 19:33 -------- d-----w- c:\program files\Maxtor
2009-10-02 19:33 . 2009-10-02 19:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Maxtor
2009-10-02 19:33 . 2009-10-02 19:33 -------- d-----w- c:\windows\Downloaded Installations
2009-10-02 19:33 . 2009-10-02 19:33 -------- d-sh--w- c:\windows\ftpcache
2009-10-02 18:49 . 2009-10-02 18:49 -------- d-----w- c:\documents and settings\Amy\Application Data\CopyTrans
2009-10-02 18:47 . 2009-10-02 18:47 -------- d-----w- c:\program files\WindSolutions
2009-10-02 18:47 . 2009-10-02 18:47 -------- d-----w- c:\documents and settings\Amy\Application Data\WindSolutions
2009-10-02 18:47 . 2009-10-02 18:47 -------- d-----w- c:\documents and settings\All Users\Application Data\WindSolutions
2009-10-01 18:10 . 2009-10-01 18:10 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-10-01 17:03 . 2009-07-28 20:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-01 01:54 . 2009-10-01 01:54 -------- d-----w- c:\program files\iPod
2009-10-01 01:54 . 2009-10-01 01:55 -------- d-----w- c:\program files\iTunes
2009-09-29 01:45 . 2009-10-06 17:10 -------- d-----w- c:\documents and settings\Amy\Local Settings\Application Data\Temp
2009-09-29 01:44 . 2009-10-06 17:10 -------- d-----w- c:\documents and settings\Amy\Local Settings\Application Data\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-18 01:44 . 2008-10-03 22:35 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-10-16 00:23 . 2009-08-17 00:56 -------- d-----w- c:\program files\SecondLife
2009-10-09 16:03 . 2008-10-09 01:55 -------- d-----w- c:\documents and settings\Amy\Application Data\Apple Computer
2009-10-08 00:28 . 2008-10-04 15:41 -------- d-----w- c:\program files\AIMTunes
2009-10-02 19:34 . 2008-10-02 13:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-01 01:54 . 2008-10-04 16:34 -------- d-----w- c:\program files\Common Files\Apple
2009-10-01 01:40 . 2008-10-10 15:52 -------- d-----w- c:\documents and settings\Amy\Application Data\LimeWire
2009-09-18 02:36 . 2009-09-18 02:36 39164 ---ha-w- c:\windows\system32\mlfcache.dat
2009-09-13 18:15 . 2009-09-13 18:14 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-13 18:12 . 2009-09-13 18:11 -------- d-----w- c:\program files\QuickTime
2009-09-13 18:05 . 2009-09-13 18:05 0 ----a-w- c:\windows\nsreg.dat
2009-09-13 02:10 . 2008-10-04 15:29 -------- d-----w- c:\documents and settings\Amy\Application Data\Yahoo!
2009-09-13 02:10 . 2009-09-13 02:10 262144 ----a-w- C:\ntuser.dat
2009-09-13 02:09 . 2008-10-04 15:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-09-11 14:18 . 2003-03-31 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 14:56 . 2008-10-08 15:56 -------- d-----w- c:\program files\Java
2009-09-04 21:03 . 2003-03-31 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-30 21:07 . 2009-08-30 21:07 94208 ----a-w- c:\windows\system32\ScrUnZip.dll
2009-08-30 20:53 . 2009-08-30 20:53 5381421 ----a-w- c:\windows\slideshow fallling leaves.scr
2009-08-30 20:53 . 2009-08-30 20:53 -------- d-----w- c:\program files\slideshow fallling leaves
2009-08-30 20:27 . 2009-08-30 20:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Individual Software
2009-08-28 21:21 . 2009-08-21 22:47 -------- d-----w- c:\documents and settings\Amy\Application Data\HpUpdate
2009-08-26 08:00 . 2003-03-31 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-21 22:47 . 2008-10-07 00:28 -------- d-----w- c:\program files\HP
2009-08-06 23:24 . 2008-10-01 23:42 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 23:24 . 2008-10-01 23:42 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 23:24 . 2008-10-01 23:42 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 23:24 . 2008-10-01 21:12 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 23:24 . 2008-10-01 23:28 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 23:24 . 2003-03-31 12:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 23:23 . 2008-10-01 23:42 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 23:23 . 2008-10-01 23:28 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2003-03-31 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 15:13 . 2003-03-31 12:00 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2002-08-29 01:04 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-07-25 09:23 . 2008-12-08 03:11 411368 ----a-w- c:\windows\system32\deploytk.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-17 1392640]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-09-17 52848]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2009-09-09 1553920]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-6-21 282624]
KODAK Software Updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-2-13 16423]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=

R1 RapportKELL;RapportKELL;c:\program files\Trusteer\Rapport\bin\RapportKELL.sys [9/14/2009 8:38 PM 58856]
R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [9/14/2009 8:38 PM 333928]
R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [9/14/2009 8:38 PM 967912]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/4/2008 11:39 AM 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/27/2009 1:42 PM 102448]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-10-17 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Amy.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2005-10-07 16:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.hotmail.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b2ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*Yahoo! SearchBar Home Page
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*Yahoo!
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: aol.com\free
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
FF - ProfilePath - c:\documents and settings\Amy\Application Data\Mozilla\Firefox\Profiles\ehhexyjp.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - Sign In
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-10-17 22:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4532)
c:\windows\system32\WININET.dll
c:\program files\Trusteer\Rapport\bin\rooksbas.dll
c:\program files\Trusteer\Rapport\bin\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2009-10-18 22:46
ComboFix-quarantined-files.txt 2009-10-18 02:46

Pre-Run: 143,997,558,784 bytes free
Post-Run: 144,025,268,224 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

207 --- E O F --- 2009-10-15 23:50

That is all Greek to me, but I hope it helps. If you would like my other logs I can try and post them tomorrow night. Thank you for the time you're taking to try and help me!!

Crush · Oct 21, 2009

CocoBean,

I would very much like the log from MBAM and CCleaner. Additionally, if you navigate to C:\ComboFix.txt you will have the other ComboFix log from your first run.

Additionally, in regards to this:

I followed advice from another link on here to run Combofix...I had no idea it was so risky to run it! It was just from another thread where someone was having issues with Facebook. Perhaps that should be clarified. If I can find the thread again I will post you the link.

It is never good to follow the advice given to someone else as the cases may be completely different. As you can see from that thread also, it is currently in Pending state. The poster never posted back so, chances are they are still infected. That is why it is good practice to observe the following:

1. We are all volunteer staff here at PCHF so we log in and assess threads when real life, work, family, and other obligations permit. Additionally, we are located all over the world. There may be a bit of a time delay due to this.

2. Malware Removal threads are very time intensive. Each entry must be researched until it can be said with 100% certainty whether or not it can stay or needs to be removed. Sometimes additional work is needed to weed out suspect entries

3. This may turn into a long ordeal but, rest assured we will stay with you until you are completely disinfected.

4. Please do not run any tools or fixes unless asked to do so by myself or a member of the Security Team

5. If you are not the original poster of this thread DO NOT run any fixes given to the poster in this thread. They are all custom tailored specifically to this user. It could prove to be disastrous. PCHF does not assume any responsibility for users that decide to do so

6. If you have any questions or issues please stop and ask! We are all here to help.

Additionally in regards to ComboFix:

Why we don't ask you to run ComboFix from the onset

As stated by the author of ComboFix:

ComboFix is a very powerful tool which when improperly used could relegate your machine to being used as a doorstop.

We first need to verify if there's any rootkits present and how they could affect our tools. HJT, and the other tools we use, are preliminary scans we use to map out the plan of attack.

With these logs we can determine the infections present & decide whether to deploy ComboFix.

I look forward to reviewing the logs

CocoaBean99 · Oct 22, 2009

Okay my bad. Sorry about that! I just thought I'd try whatever I could find until the issue was fixed. I will not do that again! So, there is more than one log for combo fix...I actually found a bunch of copies of combofix.txt. Do you want all of them? They all appear to have been generated on the same date and at the same time. They are also all the same size.

Here is the Malwarebytes Log:

Malwarebytes' Anti-Malware 1.41
Database version: 2977
Windows 5.1.2600 Service Pack 3

10/17/2009 10:31:12 PM
mbam-log-2009-10-17 (22-31-12).txt

Scan type: Full Scan (C:\|)
Objects scanned: 165837
Time elapsed: 44 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

CocoaBean99 · Oct 22, 2009

Here is the CCleaner Log:
CLEANING COMPLETE - (7.225 secs)
------------------------------------------------------------------------------------------
29.7 MB removed.
------------------------------------------------------------------------------------------

Details of files deleted
------------------------------------------------------------------------------------------
Internet Explorer - Temporary Internet Files 28,303 KB 2,156 files
Internet Explorer - Cookies 36 KB 108 files
Internet Explorer - History 112 KB 3 files
Internet Explorer - Index.dat files 0 KB 4 files
Windows Explorer - Recent Documents 5 KB 10 files
System - Temporary Files 80 KB 5 files
System - Windows Log Files 870 KB 33 files
Firefox/Mozilla - Internet Cache 0 KB 0 files
Applications - Office 2003 5 KB 7 files
Internet - Sun Java 971 KB 579 files
Multimedia - Adobe Flash Player 3 KB 23 files
------------------------------------------------------------------------------------------
It wouldn't let me post all the files it scanned....it kept saying I was over characters. *lol* If you need them I guess I can do like 7 other messages.

Crush · Oct 22, 2009

That's fine. I don't need the rest. I do however need all the ComboFix.txt files you have please

CocoaBean99 · Oct 23, 2009

Okay, so I had my computer search for all of the combofix.txt files that are on my computer and it had come up with 2,018 of them before I finally stopped the search about 6 hours later. I can't figure it out. They all appear to be sitting in the same place, are the same size and originated at the same time. I am going to copy the text from the first one and if you feel like you need the rest of them (I've looked through at least 20 of them and they all appear to be the same to me but I could be wrong) I will then try to get them all to you. Thanks!

ComboFix 09-10-16.09 - Amy 10/17/2009 22:38.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1040 [GMT -4:00]
Running from: c:\documents and settings\Amy\Desktop\ComboFix.exe
AV: Norton Internet Security 2006 *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security 2006 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((( Files Created from 2009-09-18 to 2009-10-18 )))))))))))))))))))))))))))))))
.

2019-09-26 03:40 . 2009-02-15 20:44 311977 ----a-w- c:\windows\RAIN RAIN GO AWAY.SCR
2009-10-18 01:44 . 2009-10-18 01:44 -------- d-----w- c:\documents and settings\Amy\Application Data\Malwarebytes
2009-10-18 01:44 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-18 01:43 . 2009-10-18 01:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-18 01:43 . 2009-10-18 01:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-18 01:43 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-18 01:28 . 2009-10-18 01:28 -------- d-----w- c:\program files\CCleaner
2009-10-15 16:28 . 2009-10-15 16:28 -------- d-----w- c:\documents and settings\Amy\Application Data\Motive
2009-10-15 16:27 . 2009-10-15 16:28 -------- d-----w- c:\program files\Verizon
2009-10-15 16:24 . 2009-10-15 16:28 -------- d-----w- c:\program files\Common Files\Motive
2009-10-15 16:24 . 2009-10-15 16:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2009-10-13 13:42 . 2009-10-13 13:42 -------- d-----w- c:\documents and settings\Amy\Local Settings\Application Data\AIM
2009-10-09 15:01 . 2009-10-09 15:01 -------- d-----w- c:\documents and settings\Amy\Application Data\Trusteer
2009-10-09 15:01 . 2009-10-09 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Trusteer
2009-10-09 15:01 . 2009-10-09 15:01 -------- d-----w- c:\program files\Trusteer
2009-10-06 17:51 . 2009-10-06 17:51 578560 -c--a-w- c:\windows\system32\dllcache\user32.dll
2009-10-06 17:48 . 2009-10-06 17:48 -------- d-----w- c:\windows\ERUNT
2009-10-06 17:41 . 2009-10-06 17:41 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-10-06 17:23 . 2009-10-06 18:07 -------- d-----w- C:\SDFix
2009-10-02 19:33 . 2009-10-02 19:33 -------- d-----w- c:\program files\Maxtor
2009-10-02 19:33 . 2009-10-02 19:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Maxtor
2009-10-02 19:33 . 2009-10-02 19:33 -------- d-----w- c:\windows\Downloaded Installations
2009-10-02 19:33 . 2009-10-02 19:33 -------- d-sh--w- c:\windows\ftpcache
2009-10-02 18:49 . 2009-10-02 18:49 -------- d-----w- c:\documents and settings\Amy\Application Data\CopyTrans
2009-10-02 18:47 . 2009-10-02 18:47 -------- d-----w- c:\program files\WindSolutions
2009-10-02 18:47 . 2009-10-02 18:47 -------- d-----w- c:\documents and settings\Amy\Application Data\WindSolutions
2009-10-02 18:47 . 2009-10-02 18:47 -------- d-----w- c:\documents and settings\All Users\Application Data\WindSolutions
2009-10-01 18:10 . 2009-10-01 18:10 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-10-01 17:03 . 2009-07-28 20:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-01 01:54 . 2009-10-01 01:54 -------- d-----w- c:\program files\iPod
2009-10-01 01:54 . 2009-10-01 01:55 -------- d-----w- c:\program files\iTunes
2009-09-29 01:45 . 2009-10-06 17:10 -------- d-----w- c:\documents and settings\Amy\Local Settings\Application Data\Temp
2009-09-29 01:44 . 2009-10-06 17:10 -------- d-----w- c:\documents and settings\Amy\Local Settings\Application Data\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-18 01:44 . 2008-10-03 22:35 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-10-16 00:23 . 2009-08-17 00:56 -------- d-----w- c:\program files\SecondLife
2009-10-09 16:03 . 2008-10-09 01:55 -------- d-----w- c:\documents and settings\Amy\Application Data\Apple Computer
2009-10-08 00:28 . 2008-10-04 15:41 -------- d-----w- c:\program files\AIMTunes
2009-10-02 19:34 . 2008-10-02 13:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-01 01:54 . 2008-10-04 16:34 -------- d-----w- c:\program files\Common Files\Apple
2009-10-01 01:40 . 2008-10-10 15:52 -------- d-----w- c:\documents and settings\Amy\Application Data\LimeWire
2009-09-18 02:36 . 2009-09-18 02:36 39164 ---ha-w- c:\windows\system32\mlfcache.dat
2009-09-13 18:15 . 2009-09-13 18:14 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-13 18:12 . 2009-09-13 18:11 -------- d-----w- c:\program files\QuickTime
2009-09-13 18:05 . 2009-09-13 18:05 0 ----a-w- c:\windows\nsreg.dat
2009-09-13 02:10 . 2008-10-04 15:29 -------- d-----w- c:\documents and settings\Amy\Application Data\Yahoo!
2009-09-13 02:10 . 2009-09-13 02:10 262144 ----a-w- C:\ntuser.dat
2009-09-13 02:09 . 2008-10-04 15:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-09-11 14:18 . 2003-03-31 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 14:56 . 2008-10-08 15:56 -------- d-----w- c:\program files\Java
2009-09-04 21:03 . 2003-03-31 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-30 21:07 . 2009-08-30 21:07 94208 ----a-w- c:\windows\system32\ScrUnZip.dll
2009-08-30 20:53 . 2009-08-30 20:53 5381421 ----a-w- c:\windows\slideshow fallling leaves.scr
2009-08-30 20:53 . 2009-08-30 20:53 -------- d-----w- c:\program files\slideshow fallling leaves
2009-08-30 20:27 . 2009-08-30 20:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Individual Software
2009-08-28 21:21 . 2009-08-21 22:47 -------- d-----w- c:\documents and settings\Amy\Application Data\HpUpdate
2009-08-26 08:00 . 2003-03-31 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-21 22:47 . 2008-10-07 00:28 -------- d-----w- c:\program files\HP
2009-08-06 23:24 . 2008-10-01 23:42 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 23:24 . 2008-10-01 23:42 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 23:24 . 2008-10-01 23:42 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 23:24 . 2008-10-01 21:12 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 23:24 . 2008-10-01 23:28 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 23:24 . 2003-03-31 12:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 23:23 . 2008-10-01 23:42 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 23:23 . 2008-10-01 23:28 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2003-03-31 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 15:13 . 2003-03-31 12:00 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2002-08-29 01:04 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-07-25 09:23 . 2008-12-08 03:11 411368 ----a-w- c:\windows\system32\deploytk.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-17 1392640]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-09-17 52848]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2009-09-09 1553920]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-6-21 282624]
KODAK Software Updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-2-13 16423]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=

R1 RapportKELL;RapportKELL;c:\program files\Trusteer\Rapport\bin\RapportKELL.sys [9/14/2009 8:38 PM 58856]
R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [9/14/2009 8:38 PM 333928]
R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [9/14/2009 8:38 PM 967912]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/4/2008 11:39 AM 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/27/2009 1:42 PM 102448]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-10-17 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Amy.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2005-10-07 16:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.hotmail.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b2ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*Yahoo! SearchBar Home Page
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*Yahoo!
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: aol.com\free
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
FF - ProfilePath - c:\documents and settings\Amy\Application Data\Mozilla\Firefox\Profiles\ehhexyjp.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - Sign In
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-tyc&p=
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-10-17 22:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4532)
c:\windows\system32\WININET.dll
c:\program files\Trusteer\Rapport\bin\rooksbas.dll
c:\program files\Trusteer\Rapport\bin\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2009-10-18 22:46
ComboFix-quarantined-files.txt 2009-10-18 02:46

Pre-Run: 143,997,558,784 bytes free
Post-Run: 144,025,268,224 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

207 --- E O F --- 2009-10-15 23:50

Crush · Oct 23, 2009

CocoaBean,

I'm just about to sign off for the night. I'll have a look at this in the morning when my eyes are fresh

CocoaBean99 · Oct 26, 2009

Thanks!!!

Crush · Oct 26, 2009

Hi CocoaBean,

I will be unable to check in with you. Therefore, I have PMed the rest of the Security Staff asking someone to come have a look. Someone should be along shortly. Thanks for your patience

CocoaBean99 · Oct 27, 2009

Okay. Thank you for the time you've taken so far, and for alerting someone else to my problem. I appreciate it!

Log in or Join Us

Solved Trouble Getting Facebook to Load

CocoaBean99 Bronze Member

Crush Administrator & Security Team Leader

CocoaBean99 Bronze Member

Google Advertisement

Crush Administrator & Security Team Leader

CocoaBean99 Bronze Member

CocoaBean99 Bronze Member

Crush Administrator & Security Team Leader

CocoaBean99 Bronze Member

CocoaBean99 Bronze Member

Crush Administrator & Security Team Leader

CocoaBean99 Bronze Member

Crush Administrator & Security Team Leader

CocoaBean99 Bronze Member

Crush Administrator & Security Team Leader

CocoaBean99 Bronze Member

Trouble Getting Facebook to Load

Log in or Join Us

Solved Trouble Getting Facebook to Load

CocoaBean99 Bronze Member

Crush Administrator & Security Team Leader

CocoaBean99 Bronze Member

Google Advertisement

Crush Administrator & Security Team Leader

CocoaBean99 Bronze Member

CocoaBean99 Bronze Member

Crush Administrator & Security Team Leader

CocoaBean99 Bronze Member

CocoaBean99 Bronze Member

Crush Administrator & Security Team Leader

CocoaBean99 Bronze Member

Crush Administrator & Security Team Leader

CocoaBean99 Bronze Member

Crush Administrator & Security Team Leader

CocoaBean99 Bronze Member

Trouble Getting Facebook to Load

Useful Searches