something blocking internet access to certain IPs and programs

greenknotgrace · Jul 1, 2006

it seems that something is blocking my most frequently visited IPs - myspace, photobucket, and AIM. I cannot use any of the above now, it says the server//host cannot be found. I've tried the individual IPs for the sites, and that didn't work, so it's not the hostfile. I've already scanned in safe mode with everything under the sun. This is my last hope, maybe someone knows something?

Edit: removed inline log

DavidGP · Jul 1, 2006

These are our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

Click to expand...

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)

Bitdefender

Panda Scan

HijackThis

greenknotgrace · Jul 1, 2006

yeah, i went through the tutorial, and cleared out only a few things - Virtumonde, EliteBar, and 180solutions. but still I can't access these things i use so often. sorry, i forgot to post the log as an attachment, i will now.

chaslang · Jul 1, 2006

greenknotgrace said:

yeah, i went through the tutorial, and cleared out only a few things - .
Click to expand...

Not according to your log. You need to follow ALL steps in the READ ME and you must install HijackThis properly (you skipped step 7 ) . Halo even reminded you in his message to attach three logs. You skipped step 6 completely too.

You must run ALL steps in the READ ME and in the order given.

greenknotgrace · Jul 2, 2006

alright, sorry. i ran the entire process again, from scratch, and saved the required logfiles. I started safe mode, ran CCleaner, F-Prot, Windows Defender, Windows Malicious Software Removal, then Spybot, in that order. Found nothing. Then I restarted into safe mode with networking and ran Bitdefender (found nothing), and then Panda Antivirus, and found one dirty little spyware called Cookie/2o7. Panda didn't do anything about it, and nothing else picked it up. I still can't connect to my most frequent connections (now i'm up to AIM, AIMexpress, myspace, and photobucket). Logs enclosed.

chaslang · Jul 3, 2006

Make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O15 - Trusted Zone: *.line6.net

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\winupdates <--- the whole folder
C:\Program Files\outlook <--- the whole folder

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now reboot in normal mode and post a new HJT log.

Make sure you tell me how things are working now.

Note: You also have the Sony DRM rootkit that most people remove! See: http://www.bleepingcomputer.com/forums/topic34904.html

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

greenknotgrace · Jul 3, 2006

done, done, and done - and the problem persists.
it might not be malware - i don't know what else would cause this, but there is a chance it's not malware of any type.

the problem, in detail, is that i can't connect to (anything).myspace.com, photobucket.com, aimexpress.aol.com, or the AIM service. for everything except the AIM program, it says the "server could not be found". for an example screen, screw up the url, like type in ww.myspace.com.

here's the updated HJT log. what the hell is going on?

chaslang · Jul 3, 2006

I don't believe it is malware either since we fixed all of your malware already.

Check to make sure you are not blocking sites in your firewall or other security software.

Flush your DNS cache (from a command prompt window, enter ipconfig /flushdns )

Power cycle your router if you have one. Also make sure any firewall in your router is not blocking you.

Log in or Sign up

something blocking internet access to certain IPs and programs

greenknotgrace Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

greenknotgrace Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

greenknotgrace Private E-2

Attached Files:

BitDefender log.txt

Activescan.txt

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

greenknotgrace Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member