Totally stumped..IE/FF problem

[xbreaka]

Alright guys, I'm totally out of ideas on this one. Anyways heres whats going on. Recently certain sites like gmail, facebook, myspace, blogspot,techspot all refuse to load. The browsers seems to just hang there. Google itself will only usually do one search before it to decides to stop functioning. However most of the other sites I visit work fine.

First order of business I did a couple virus scans, found a ton of nasty shit including virtumonde, some hijackers and things like that. Nod32 was able to get most of it. I then ran ad-aware 07, along with hitman pro and found some other various junk. I ran hijack this and have what it found attached here-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:48:34 PM, on 4/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Winamp\winamp.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [BMa7af8f38] Rundll32.exe "C:\WINDOWS\system32\gpocmlxr.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA0C20EA-281A-4540-AFE8-4B6BF876D2E4}: NameServer = 68.87.71.226,68.87.73.242
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 3686 bytes


Just for kicks i tried re-registering all the .dlls that have to do with secure sites, that didnt help. I ran Chkdsk, registry mechanic, and tweak now registry cleaner.

I know that this is not a network issue, as the other computers here work fine, and it is not my network settings as this problem does NOT occur when i access the internet in safe mode w/networking.

Iv tried all the normal stuff, cleared FF's cache, cookies all that stuff. Opera,IE,and FF all have the same issue. I would upload a screenshot of my connection status but photobucket wont work all that well either.

But currently its about 7800 packets sent to about 4200 packets recieved.

What else should I try? Uninstall Nod32 and try AVG?

 

[Malk-a-mite]

telnet google.com 80

get index.html


You should get back something that looks like this:

<html><head><meta http-equiv="content-type" content="text/html; charset=ISO-8859
-1"><title>Google</title><style>body,td,a,p,.h{font-family:arial,sans-serif}.h{f
ont-size:20px}.h{color:#3366cc}.q{color:#00c}.ts td{padding:0}.ts{border-collaps
e:collapse}.lnc:link,.lnc:visited{color:#00c}.pgtab,.pgtab:hover,.pgtabselected,
.pgtabside{text-align:center;text-decoration:none;color:#00c;display:block;heigh
t:27px;float:left;overflow:hidden;background:url(/intl/ja/images/productlinktabs
.png) no-repeat;padding-top:8px}.pgtab{width:130px;background-position:-274px 0}
.pgtab:hover{width:130px;background-position:-144px 0}.pgtabselected{width:144px
}.pgtabside{width:3px;background-position:-404px 0}.ptr{cursor:pointer;cursor:ha
nd}.iconl{background:url() no-repeat;overflow:hidden;height:px;width:px}</style>
<script>window.google={kEI:"4R8MSOXbDo-siAHIhKn8Ag",kEXPI:"17259,17735",kHL:"en"

If that works, it is the browsers themselves that are compromised still, if that doesn't work I would start by having a look at how DNS is resolving on your system.

 

[evandena]

What is this?
O4 - HKLM\..\Run: [BMa7af8f38] Rundll32.exe "C:\WINDOWS\system32\gpocmlxr.dll",s