[Raynor7]

Hello everyone,

I had a little problem with Firefox right now. A few hours ago, I got viruses on my computer from an ad, these viruses made it so I could not open anything such as regedit, system restore, safe mode, IE, Firefox, Malware bytes, etc. After doing some research online, I found the answer to make Malware bytes run and it removed all of the viruses/spyware/malware. The only problem im having now is that Firefox keeps bringing up the "Mozilla Crash Reporter" everytime I open up Firefox, Firefox will NOT open. I did research online and couldn't find the answer and was hoping someone here could help me? Id greatly appreciate it. Im running Windows XP home edition service pack 3. I want to fix it ASAP.

Thanks
Raynor7

[Phantom010]

Please click here to download and install the HijackThis installer.

Run it and select Do a system scan and save a logfile.

The log will be saved in Notepad. Copy and paste the log in your next post.

Do not fix anything

Then,

Please start a new thread in the Malware Removal forum. You may still have traces of infections.

[throoper]

Quick thing to try is to go into the Firefox Program folder, C:/Program Files/Mozilla Firefox, find the firefox.exe and rename it to firefox1.exe. Double click it and see if Firefox will start up.
If it doesn't, download a new copy of Firefox, uninstall the existing Firefox (don't remove your personal data), and install the new one.
You may still have malware targeting Firefox and should have this moved to the Security forum to get checked out as a precaution.

[throoper]

And do as Phantom says.

[Raynor7]

Ok thanks for the response, I made a log file and have it ready on my desktop, theres only 1 problem. I dont know why, but its not letting me post in the Malware section, it keeps logging me out, I dont know what the problem is, can you have someone from there help me out?

[Phantom010]

Perhaps you haven't waited long enough between your two last posts. If it still doesn't work, post your log here.

[Raynor7]

Throoper - I renamed it and it didnt work.

Phantom - I tried it several times didnt work. Heres the log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:52:42 PM, on 7/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Program Files\DNA\btdna.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\g5x7uviv4g.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\g5x7uviv4g.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\install.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\g5x7uviv4g.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\AstSrv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\services.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\notepad.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\win.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\debug.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\winamp.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\smss.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\spoolsv.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\winlogon.exe
C:\DOCUME~1\Farhan\LOCALS~1\Temp\setup.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {D76AB2A1-00F3-42BD-F434-00BBC39C8953} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [EPSON Stylus CX5000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVA.EXE /FU "C:\WINDOWS\TEMP\E_S392.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE"
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [] C:\DOCUME~1\Farhan\LOCALS~1\Temp\g5x7uviv4g.exe
O4 - HKCU\..\Run: [hsf7husjnfg98gi498aejhiugjkdg4] C:\DOCUME~1\Farhan\LOCALS~1\Temp\g5x7uviv4g.exe
O4 - HKCU\..\Run: [Windows System Recover!] C:\DOCUME~1\Farhan\LOCALS~1\Temp\winlogon.exe
O4 - HKUS\S-1-5-19\..\Run: [jakujagiwi] Rundll32.exe "C:\WINDOWS\system32\pijulofu.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [jakujagiwi] Rundll32.exe "C:\WINDOWS\system32\pijulofu.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{EEFC6111-E381-4DBC-9379-A73FBD8CDB10}: NameServer = 192.168.0.1
O20 - AppInit_DLLs: tuttkn.dll ,C:\DOCUME~1\Farhan\LOCALS~1\Temp\11911750614mxx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AST Service (astcc) - Advanced Software Technologies - C:\WINDOWS\system32\AstSrv.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O24 - Desktop Component 0: (no name) - (no file)
--
End of file - 9099 bytes

[throoper]

If it didn't work, change it back to firefox.exe before you try to uninstall/reinstall.

[Raynor7]

Throoper - I changed it back. I want reinstalling it to be a last option because im not sure how to save bookmarks. I found a post on here that showed how to do it, but the link they gave on that post was unavailable.

[Raynor7]

Ok another thing happened, I went online and found a program thats supposed to help me open regedit. I checked a minute ago and the problem with opening regedit is back, the only way I can open it is if I run the program. I opened regedit and I looked at the system restore and it happens to be turning itself off?

[throoper]

Originally Posted by Raynor7

Throoper - I changed it back. I want reinstalling it to be a last option because im not sure how to save bookmarks. I found a post on here that showed how to do it, but the link they gave on that post was unavailable.

Hold off on that anyway. I stink at reading HJT logs, but I think I see a problem and hopefully Phantom010 can advise you better than I.

[Raynor7]

Throoper - Im waiting for his response, im trying to get this done before my brother gets home.

[throoper]

I don't think that's going to happen. If I'm reading it correctly (I did mention I stink at that ), you've got some serious problems. I'm not qualified to advise on Malware issues, so the best I can suggest is to contact a moderator and have them move this into the Malware forum as soon as possible.
Just click the Report button.

[Raynor7]

ummm... He went offline?? Ok I ran to my downstairs comp and that one seems to be working, I just posted a new thread. Serious problems?? Will I be able to remove it?

[throoper]

The folks in security are really good and should be able to get things cleaned up.
Plus I could be wrong. Remember? Stink? HJT logs?
Just in case, though, you might want to give some thought to what really nice thing you're going to do for your brother so he forgives you.