Whilst waiting for someone that can analyse your OTS log:
You could remove these entries from your HOSTS file manually.
HOSTS file redirect a common malware tactic to block AV sites making it difficult to remove malware; the same is true if they want to block facebook in your case - 127.0.0.1 check your HOSTS file using notepad or a text editor of your choice, C:\WINDOWS\system32\drivers\etc\hosts or do a search for HOSTS to find it if not there.
Note, when saving the file, notepad may have a whinge as there is no file type for the HOSTS file; ensure that the file type is set to all files and it should comply with the fact it hasn’t got a file type/extension. You may, depending on your OS have the UAC have a whinge, so you may need to run that text editor (notepad, etc.) as an administrator.
This hopefully should allow you access to facebook, but be careful on facebook as there are many so called friends trying to sucker you.
It may be that the person analysing your OTS log may ask you to run another tool to further analyse your system so I will give you the info on that so you can prepare it too.
Note these files should be small enough to attach to your post (under 200KB) using the Additional Options link in the Reply window. If both don’t fit, attach one in the post and the other one in a second post. Saves having to upload to mediafire.
I’m not the OTL expert, but as far as I’m aware if you have lots of temporary files the scan takes much longer. So perhaps you could clear your temporary files before starting it. Edit: I see you have now run OTL, I will try and get someone to analyse it.
On completion of this run could you zip the following folder : C:_OTL and upload to MegaUpload and post the link please
Mediafire is not working for me for some reason
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
thank you both for assistance, I guess this one’s a badass.
In about an hour I’ll get to the infected Notebook, and I’ll get you the logs you asked for.
All processes killed
========== OTL ==========
No active process named svchostdriver.exe was found!
Service sppuinotify stopped successfully!
Service sppuinotify deleted successfully!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{40f5f417-32bb-4296-9446-c1e0094e7d82} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40f5f417-32bb-4296-9446-c1e0094e7d82}\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1851263083-776427828-930987571-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{40f5f417-32bb-4296-9446-c1e0094e7d82} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40f5f417-32bb-4296-9446-c1e0094e7d82}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SxgTkBar deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tray_ico deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tray_ico1 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tray_ico2 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tray_ico3 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\tray_ico4 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\\AlternateShell deleted successfully.
C:\Windows\info1 moved successfully.
C:\Windows\systemup.exe moved successfully.
C:\Windows\ufa folder moved successfully.
C:\Windows\rpcminer folder moved successfully.
C:\Windows\phoenix\kernels\poclbm folder moved successfully.
C:\Windows\phoenix\kernels\phatk folder moved successfully.
C:\Windows\phoenix\kernels folder moved successfully.
C:\Windows\phoenix folder moved successfully.
C:\Windows\update.5.0 folder moved successfully.
C:\Windows\update.2 folder moved successfully.
C:\Windows\update.7.1 folder moved successfully.
C:\Windows\av_ico folder moved successfully.
C:\Windows\update.1 folder moved successfully.
C:\Windows\update.tray-7-0-lnk folder moved successfully.
C:\Windows\update.tray-7-0 folder moved successfully.
C:\Windows\geoiplist.rar moved successfully.
C:\Windows\unrar.exe moved successfully.
C:\Windows\phoenix.rar moved successfully.
C:\Windows\rpcminer.rar moved successfully.
C:\Windows\ufa.rar moved successfully.
C:\Windows\l1rezerv.exe moved successfully.
C:\Windows\loader2.exe_ok moved successfully.
C:\Windows\sysdriver32_.exe moved successfully.
C:\Windows\sysdriver32.exe moved successfully.
C:\Windows\services32.exe moved successfully.
File C:\Windows\systemup.exe not found.
C:\setup_av_free.exe moved successfully.
File C:\Windows\phoenix.rar not found.
File C:\Windows\rpcminer.rar not found.
File C:\Windows\ufa.rar not found.
File C:\Windows\l1rezerv.exe not found.
C:\Windows\geoiplist moved successfully.
File C:\Windows\geoiplist.rar not found.
File C:\Windows\unrar.exe not found.
File C:\Windows\info1 not found.
File C:\Windows\loader2.exe_ok not found.
File C:\Windows\sysdriver32_.exe not found.
File C:\Windows\sysdriver32.exe not found.
C:\Windows\System32\Ikeext.etl moved successfully.
File C:\Windows\services32.exe not found.
File C:\Windows\update.1\svchost.exe not found.
File C:\Windows\update.tray-7-0\svchost.exe not found.
File C:\Windows\update.tray-7-0-lnk\svchost.exe not found.
File C:\Windows\update.5.0\svchost.exe not found.
File C:\Windows\update.2\svchost.exe not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\dj\Downloads\cmd.bat deleted successfully.
C:\Users\dj\Downloads\cmd.txt deleted successfully.
File\Folder C:\Windows\update.1 not found.
File\Folder C:\Windows\update.tray-7-0 not found.
File\Folder C:\Windows\update.tray-7-0-lnk not found.
File\Folder C:\Windows\update.5.0 not found.
File\Folder C:\Windows\update.2 not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
After we fixed this, I was asked by a user to check if his facebook acc is available. When I logged in with his data, his account was blocked due a virus known as “Koobface” and after a friend photo check, I was asked to download and run McAfee Scan & Repair, as part of restoring facbook account process.
OK just one legacy registry key to remove and a stray BHO
You will need to re-install Avast, maybe a repair would work. What are the current problems ?
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL
SRV - File not found [Auto | Stopped] -- -- (ddservice)
O3 - HKLM\..\Toolbar: (no name) - {40f5f417-32bb-4296-9446-c1e0094e7d82} - No CLSID value found.
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Aside from facebook trouble, no other problems have been encountered, except known problems like avast not working, and not being able to stay in safe mode. system restore didn’t work also.
Your fix worked fine, as McAfee which was recomended by facebook didn’t find anything after the fix.
I just reinstalled Avast, and it warned me about OTL.exe, wanted me to run it sandboxed.
I ran it normally, so here is the newest log.
All of the above checked, Safe mode ok, sys restore ok, windows update failed with code C004F012, but I’m unable to tell if it worked before the infection. It’s not my computer. The Windows installed is not legal and I don’t know how it was activated.