Problema strano, internet funziona ma con alcune applicazioni no

[Gonius]

salve,
ho aggiornato firefox e non funziona piu internet da li, strano perche non funziona neanche l'aggiornamento dell'antivirus eppure da ie e skype nessun problema

se installo un programma nuovo internet nn funziona, ho controllato firewall etc, avendo un minimo di background it, pur disattivando il firewall niente

ho controllato pure le impostazioni


cosa altro posso fare ?

[Dumah Brazorf]

Scansione antivirus dalla modalità provvisoria con rete. Che anche l'antivirus sia bloccato non è carino.

[Braveheart84rm]

provato un altro browser?

[Gonius]

il problema è che il pc nn era aggiornato e l'antivirus che ho messo (avira) non riesce a scaricare le definizioni nuove quindi anche se facessi uno scan non ci sarebbero le definizioni dei virus, a questo punto che fare?

[Dumah Brazorf]

Si passa alle medicine forti.
Scarica combofix (http://www.bleepingcomputer.com/download/combofix/) e passalo sul pc in modalità provvisoria. Esegui e attendi il report finale, un file di testo piuttosto prolisso.
Riavvia e vedi se:
-il sistema riparte :p
-l'antivirus riesce ad aggiornarsi.
Aggiorna l'aggiornabile e riscanna con l'antivirus meglio da boot o da modalità provvisoria.

[Gonius]

Ho fatto comre mi hai detto ma nulla, non funziona

a questo punto cosa fare ?



ti incollo il log di combofix


ComboFix 13-03-31.01 - 45310 01/04/2013 10.45.13.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.39.1040.18.3000.1871 [GMT 2:00]
Eseguito da: c:\users\45310\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Outdated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Outdated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Autorun.inf
c:\programdata\Roaming
c:\programdata\Roaming\Intel\Wireless\Settings\Settings.ini
C:\setup.exe
c:\users\45310\AppData\Local\Microsoft\Windows\Temporary Internet Files\{2E266640-2AE9-481A-B8E1-270E7BC97CD7}.xps
c:\users\45310\AppData\Local\Microsoft\Windows\Temporary Internet Files\{2FF76D63-4DC2-4FFF-BABA-2167E6A1E071}.xps
c:\users\45310\AppData\Local\Microsoft\Windows\Temporary Internet Files\{3255321E-B827-47BE-AF06-B054670F9DF4}.xps
c:\users\45310\AppData\Local\Microsoft\Windows\Temporary Internet Files\{54576F17-EC45-4452-B77A-7548148EA7D4}.xps
c:\users\45310\AppData\Local\Microsoft\Windows\Temporary Internet Files\{5A1DFB76-7DBD-4DC6-BB9B-4906B607D2BC}.xps
c:\users\45310\AppData\Local\Microsoft\Windows\Temporary Internet Files\{5BB5F6D9-B27D-4CF3-BA2B-4DD034F5F60D}.xps
c:\users\45310\AppData\Local\Microsoft\Windows\Temporary Internet Files\{6F23A662-1D3F-4CB6-B5BD-3D47667A4785}.xps
c:\users\45310\AppData\Local\Microsoft\Windows\Temporary Internet Files\{71648F27-8841-4390-AAA2-31003F26829C}.xps
c:\users\45310\AppData\Local\Microsoft\Windows\Temporary Internet Files\{721B261F-2DD2-4E59-90A3-F0F7114E177B}.xps
c:\users\45310\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A78D1E51-A3D6-40DC-B071-5AC85D16064A}.xps
c:\users\45310\AppData\Local\Microsoft\Windows\Temporary Internet Files\{D68160B7-EE19-43EA-B44F-9BEEBA8B44BD}.xps
c:\users\45310\AppData\Local\Microsoft\Windows\Temporary Internet Files\{E5649020-D4E2-4D8B-BFD2-0270E828E15E}.xps
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((( Files Creati Da 2013-03-01 al 2013-04-01 )))))))))))))))))))))))))))))))))))
.
.
2013-04-01 08:52 . 2013-04-01 08:52 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-03-24 10:35 . 2013-03-24 10:35 -------- d-----w- c:\program files\Common Files\Skype
2013-03-24 10:35 . 2013-03-24 10:35 -------- d-----r- c:\program files\Skype
2013-03-21 10:01 . 2013-03-21 10:01 -------- d-----w- c:\users\45310\AppData\Roaming\Avira
2013-03-21 09:58 . 2012-11-22 14:51 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-03-21 09:58 . 2012-11-22 14:50 134336 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-03-21 09:58 . 2013-03-21 09:58 -------- d-----w- c:\programdata\Avira
2013-03-21 09:58 . 2013-03-21 09:58 -------- d-----w- c:\program files\Avira
2013-03-21 09:30 . 2013-03-21 09:30 -------- d-----w- c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP
2013-03-21 09:26 . 2013-02-19 03:58 6954968 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DCB9743B-B490-40C4-8EC0-6E524DB7DEB1}\mpengine.dll
2013-03-21 09:26 . 2013-01-17 00:28 232336 ------w- c:\windows\system32\MpSigStub.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-17 19:14 . 2013-02-17 19:14 405360 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-07 14:30 . 2013-03-26 08:42 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2010-07-08 18:20 . 2010-04-17 20:58 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\program files\Packard Bell\SetUpMyPC\SmpSys.exe" [2008-02-04 1038136]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-01-08 18705664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-08 894512]
"RtHDVCpl"="RtHDVCpl.exe" [2008-08-04 6265376]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-12 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-12 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-12 145944]
"CarboniteSetupLite"="c:\program files\Packard Bell\Carbonite\CarboniteSetupLitePBPreInstaller.exe" [2008-04-07 306112]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-08 30192]
"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2009-03-05 77824]
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2007-05-04 36864]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"ConnMonitor"="c:\program files\Alice Mobile Olicard 100\ConnMonitor.exe" [2009-06-18 401408]
"ModemListener"="c:\program files\Chiavetta Internet Olicard 145\ModemListener.exe" [2010-04-15 98304]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-01-23 385248]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 21:11 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiSpywareOverride"=dword:00000001
.
R3 acfva;acfva;c:\windows\system32\DRIVERS\ACFVA32.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-03-23 07:14 1629648 ----a-w- c:\program files\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe
.
Contenuto della cartella 'Scheduled Tasks'
.
2013-04-01 c:\windows\Tasks\Garanzia estesa-45310.job
- c:\program files\Packard Bell\SetupmyPC\PBCarNot.exe [2008-09-05 09:13]
.
2013-04-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-28 21:59]
.
2013-03-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-28 21:59]
.
2013-04-01 c:\windows\Tasks\Recovery DVD Creator-45310.job
- c:\program files\Packard Bell\SetupMyPc\MCDCheck.exe [2008-09-05 09:13]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: I&nvia a OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{7A746911-078F-430C-8A0E-44C65DB8B445}: NameServer = 8.8.8.8,4.4.4.4
DPF: {A319CB66-0653-4E38-B880-EB652B8E6303} - file:///D:/Corso/Corso/NETgJREDetect1.CAB
FF - ProfilePath - c:\users\45310\AppData\Roaming\Mozilla\Firefox\Profiles\n6iffvnz.default\
FF - prefs.js: network.proxy.type - 4
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-04-01 10:52
Windows 6.0.6001 Service Pack 1 NTFS
.
scansione processi nascosti ...
.
scansione entrate autostart nascoste ...
.
Scansione files nascosti ...
.
Scansione completata con successo
Files nascosti: 0
.
**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Ora fine scansione: 2013-04-01 10:54:52
ComboFix-quarantined-files.txt 2013-04-01 08:54
.
Pre-Run: 227.368.538.112 byte disponibili
Post-Run: 227.402.850.304 byte disponibili
.
- - End Of File - - FAAB5765281A58410C02C0DAE8C33C7F

[Dumah Brazorf]

Controlla il file hosts. Non ha estensione e si trova nella cartella c:\windows\system32\drivers\etc Si apre col blocco note.
Scendi al paragrafo "correzione manuale" per maggiori dettagli. Assicurati che non ci siano voci del tipo
127.0.0.1 www.microsoft.com
127.0.0.1 www.avast.com

Nel dubbio sega tutto e lascia solo le prime righe che iniziano con la #. Occhio a salvare come "Tutti i file" senza terminare il nome con .txt o altro.
Riavvia e controlla che non sia stato riscritto.

[Gonius]

fatto

il file host è ok, sai cosa se riuscissi ad utilizzare internet in modalita provvisoria potrei aggiornare l'antivirus etc

purtroppo in modalita provvisoria la rete non è identificata e se imposto l'ip manualmente cmq non funziona

[Dumah Brazorf]

C'è la modalità provvisoria con supporto di rete, quella con prompt dei comandi non ce l'ha.