Firefox can't access certain pages!

[LIMPET235]

No-one has mentioned going to a virus removal site for help with this beast.
Maybe if you go to any of these, you may get the required assistance...
http://castlecops.com/
http://www.spywarewarrior.com/index.php
http://forum.aumha.org/
http://forums.spywareinfo.com/
Only post on one forum.
These guys do this all the time, so be patient & thorough..

[Ron L]

Just read thru this and this is exactly what my machine is doing.

Google won't search, Yahoo won't display anything, and on some forums, if there are sub-forums, I can't open threads. Things seem to work fine on IE, tho a little slow.

Stranger yet, whether through Windows or the AdAware mode, my system will NOT allow a system restore.

Avast started finding a couple of vundo trojans on Apr 15 and 16. Avast cleaned out a couple of .dll files from the system32 folder that I can't find any reference to; yayaYstr.dll and urqOIcu.dll, so these sound like the same random-named files that another poster mentioned.

I found that if I go to Control Panel and uninstall Firefox and reinstall, it will work fine. If I turn off the machine, the following day, once started, it's FUBAR again.

Has anybody found any other resolution yet? Since I'm new here, this may sound like a dumb question, but is anybody from Mozilla looking into this since it seems to affect Firefox?

[Hacienda]

Have exactly the same problem since firefox updated, the problem does not occur in IE7 I'm unable to access hotmail unable to google anything after reading this thread I checked other threads mentioned by people and indeed they also don't work in FF, I have had a warning from NOD32 regarding win32/sdbot in a restore point file scanned in safe mode and removed it but it hasn't made any difference to firefox and so far have been unable to find any unusual regestry entries or processes.

[Guest]

Have exactly the same problem since firefox updated, the problem does not occur in IE7 I'm unable to access hotmail unable to google anything after reading this thread I checked other WEBSITES mentioned by people and indeed they also don't work in FF, I have had a warning from NOD32 regarding win32/sdbot in a restore point file scanned in safe mode and removed it but it hasn't made any difference to firefox and so far have been unable to find any unusual regestry entries or processes.

No edit button, sorry for quoting whole post to correct one word but it didn't make any sense

[Hacienda]

Solved this issue with hijackthis found this entry O4 - HKLM\..\Run: [BMcfe7b8b8] Rundll32.exe "C:\WINDOWS\system32\cporyvjb.dll",s
seems to be a randomly generated name though so if your issue is the same the cporyvjb.dll may differ once I'd found it the rest was easy Just simply boot in safe mode (f8 whilst booting up) log in as administrator run hijack this and "fix" the entry then navigate to C:\WINDOWS\system32\cporyvjb.dll and manually delete it restart.

I can now navigate to all of the sites I previously couldn't, I do think theres possably more to this though and will keep looking if I find anything else will post back.

hope this was of help.

[LoudNoise]

Ok folks.

1) If you post without a name of some sort I am going to ignore you. Sorry, but I am not going to guess which <i>Guest</i> has which problem.
2) Run at least two different AV scans on your system. If you have norton then run three scans. KAV has an online scanner which does a pretty good job.
Make sure you stop your current AV before running the next.
3) If you find a nasty, remove it and it comes back go the one of the places suggested by Limpet here: http://forums.mozillazine.org/viewtopic ... 75#3344575
4) If you post, tell us what you have done already.

<b> NOTE: This is a forum to support Firefox. We can make Firefox sing and dance. If you are looking for competent help for removing complex viruses from your system you simply are not going to find much of it here.</B>

[Ron L]

Well, I started at the Castlecops website and followed along w/ the Malware Removal instructions. I ran the Hijackthis log just to have a baseline. I wasn't sure what the issue was so I skipped to step 4. I didn't find anything in Add/Remove Programs. Then I disabled real-time monitoring programs, ran ATF Cleaner, then began with Spybot and then Adaware. Spybot caught the Virtumundo crap (if I had know this, I could have performed step 2). There was a lot of fixing to do and some registry files needed to be fixed. I let Spybot fix them as they came up. I ran another scan with Avast and it came back clean. I tried FF and everything seemed to work. Just to be sure, I shut the machine down and when it rebooted, Spybot had to correct a few more registry files. I rebooted again and a couple more files needed to be corrected. Rebooted a fourth time and all is well. After each reboot, FF was working fine to Yahoo and a forum I had a problem with before.

Sorry so long, but there's light at the end of the tunnel and this problem can be fixed!

Good luck all!

[shadezula816]

ok so i was going through the steps
and one of the items on my add/remove programs list was "Adware & Spyware"
but when i click to remove it, it opens a link to adware remover gold
i'm gonna go out on a limb and say its bad
if i continue the steps should it remove it anyways? or what should i do?

[LoudNoise]

Adware Remover Gold is a liget program. You either got it free from the PC manufacture or you purchased it at some time. That said there is no reason not to remove it. I personally use SuperAntiSpyware and Spybot Search and Destroy (don't install Teatimer from the second package). Both are free and seem to cover most bases.

[Resshin]

hi everyone,

I've been having the exact issue with Internet browser hanging. I said Internet browser because IE, Optra also have the same problem.

Though thanks to Gangleri, I managed to find some wicky file in the msconfig. in my case it was gwwqlk.dll

after removing the file everything is working fine again.

Just want to throw the idea out there and hopefully it'll help someone.

[akn320]

prelude23-strangely enough, now both IE AND firefox dont work for ANY page, but i tried safari and it works for ALL pages...
and yes, i think i have the same problem as you-found 15 instances of a tratBHO trojan

[46&2]

This has been difficult.

My recollections may be difficult to follow(or remember), but here they are.

It started in early March 08. I think it began with a Flash upgrade, but I can't be sure (more later).

After this upgrade, I was unable to view akamai hosted web pages (cbs.com, ncaa.com, nbc.com, etc).

I sniffed my NIC and saw that there was a lot of SSDP traffic on it. I looked it up on google and learned about UPnP, which had several vulnerability postings about it.

I then stopped and disabled the SSDP Discovery Service on my PC. This happened to coincide with the auto upgrade to Firefox 2.0.0.13. Magic! I could now view the akamai based pages that were previously failing. Failure being defined as a continuous "waiting for response from *.*" message in the bottom area of the Firefox app while being able to ping the URL in question.

The Magic didn't last long...my ability to view content from these sites was sporadic at best.

I looked through my msconfig startup tab and see a "Run" entry with some gibberish dll file in there, just like prelude23 . I rename the file and remove the registry entry, reboot and I get some message about updating Flash player??? Whoa mule...I decline the upgrade.

The most recent incarnation of this beast was the reception of a blank page and a "Done" indication at the bottom of the app when I tried to load hotmail.com. This occurred after my recent auto upgrade to Firefox 2.0.0.14. Works fine on another PC in the same LAN. SonuvaBush!

I find this page and start jumping through it's hoops as suggested by LIMPET235 in http://forums.mozillazine.org/viewtopic ... 75#3344575. (Note to LoudNoise: if every guest posting has the EXACT same problem, do you really need to identify the guest? TRY TO DUPLICATE IT! no singing or dancing required.) First stop http://castlecops.com/. I run through their Malware_Removal_and_Prevention:_Overview. Multiple times! I still keep coming up with Virtumonde.dll files in C:\WINDOWS\system32. At one point it won't let me go back to the Malware_Removal_and_Prevention:_Overview page as well as my home page wikipedia.org. GRRRRRRRRRRRRRRRRRR!

I sniff the NIC again and see that it is going to 82.98.235.70 and running a "GET" command, in the content of that packet I see a redirection to 89.188.16.50 to download the file "css4.dll." I think it is also telling the machine at the other end what the last pages I was viewing were. This could explain why I couldn't access my home page or the Malware_Removal_and_Prevention:_Overview page. I'm not sure because when I clicked on the packet that contained the text "application/x-msdownload" my sniffer (Ethereal) went "non-responding" in task manager. AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARRRRRRRRRRRRRRGH!

Next step...create static routes on my PC for the 82.98.255.0/24 & 89.188.16.0/24 networks pointing to a bogus IP on my LAN. Reboot & sniff, I see an ARP entry asking for who has the address that I pointed these addresses to. Progress? No auto download of css4.dll, I hope.

I run through the Malware_Removal_and_Prevention:_Overview drill completely. Reboot. Sniff. I'm still seeing SSDP traffic coming from my Linksys. Log into it, and try to disable UPnP traffic (SSDP & UPnP sort of work together) and the page to disable UPnP turns out to also be the Password page. Now, I can't login to the Linksys because my password has been changed to something I don't know. Reset the Linksys to factory defaults, reacquire an IP, and reboot PC. Reboot the PC and sniff. Looking good, so far. Time will tell...

[LoudNoise]

I find this page and start jumping through it's hoops as suggested by LIMPET235 in http://forums.mozillazine.org/viewtopic ... 75#3344575. (Note to LoudNoise: if every guest posting has the EXACT same problem, do you really need to identify the guest? TRY TO DUPLICATE IT! no singing or dancing required.)

Yes.
1) If I know who I am talking to I know the advice I gave earlier. If I have talking to twelve guests I haven't a clue what the folks tried.
2) If I know who I am talking to I have a pretty good idea how much information I need to give. For example, I would ask you what is listed in msconfig start. Other folks I would need to explain how to get there.
3) After the problem is solved there could be other unique problems that need to be cleaned up.
4) It is simply much easier to see what is going on and who made a mistake when we have names.

As for TRYING TO DUPLICATE IT goes my desire to help does not include getting a virus. In that way I guess I am just lacking the proper Zeal

[lulusoccer]

So, I'm glad other people are having the exact same problem as me, because I have done everything to try and fix it and I don't know what else to do. The only sites that I'm having problems with are www.neopets.com, and www.facebook.com. There could be more, but those are the only two that I've noticed because I visit them often. They just won't load, in either firefox or IE7, but I noticed it after I updated my latest version of firefox.

I've ran 2 spyware programs and deleted what they found (mainly just tracking cookies) I have AVG that runs everyday with no viruses. I updated my java to the latest version, I've deleted all cookies, cache, and temporary internet files, and NOTHING has made it better.

I have a hijackthis file if anybody knows how to read it, but if anybody gets there internet working again say what you did because I am having no luck on it...

Thanks!

[LoudNoise]

You can post the log here: http://www.castlecops.com/f67-Hijackthi ... Oh_My.html