Il pc è connesso ma non apre le pagine internet

[MirrorHole]

Ciao a tutti!
Ho un problema con un portatile (non mio) su cui è installato Windows Xp SP3. Non so se questa è la sezione giusta (in caso contrario me ne scuso) ma credo che qualche bestiaccia lo abbia infettato...almeno credo!
I problemi sono: il computer è connesso ma non riesce ad aprire le pagine internet con nessun browser provato (internet explorer e firefox) ed in più è non è possibile utilizzare nemmeno msn, mentre skype funziona!
Il firewall di Xp sembra essere ok.

Questo è il log di hijackthis:

Logfile of Trend Micro HijackThis v2.0.3 (BETA)

Scan saved at 23.41.30, on 03/01/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16945)

Boot mode: Normal



Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

C:\Programmi\CheckPoint\ZAForceField\IswSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programmi\Avira\AntiVir Desktop\sched.exe

C:\Programmi\CheckPoint\ZAForceField\ForceField.exe

C:\Programmi\Avira\AntiVir Desktop\avguard.exe

C:\Programmi\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Programmi\SRS Labs\SRS Premium Sound\SRS_VolSync.exe

C:\WINDOWS\system32\svchost.exe

C:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Programmi\Parental Control\bin\pcontrol.exe

C:\Programmi\Asus\LiveUpdate\LiveUpdate.exe

C:\Programmi\Synaptics\SynTP\SynTPEnh.exe

C:\Programmi\EeePC\ACPI\AsAcpiSvr.exe

C:\Programmi\EeePC\ACPI\AsEPCMon.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\igfxext.exe

C:\Programmi\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Programmi\Hewlett-Packard\OrderReminder\OrderReminder.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\PersistenceThread.exe

C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programmi\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe

C:\Programmi\Windows Live\Messenger\msnmsgr.exe

C:\Programmi\WIDCOMM\Bluetooth Software\BTTray.exe

C:\WINDOWS\system32\msiexec.exe

C:\Programmi\TrendMicro\HiJackThis\HiJackThis.exe



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programmi\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programmi\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll

O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programmi\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programmi\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programmi\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll

O4 - HKLM\..\Run: [Parental Control] "C:\Programmi\Parental Control\bin\pcontrol.exe" --start

O4 - HKLM\..\Run: [LiveUpdate] C:\Programmi\Asus\LiveUpdate\LiveUpdate.exe auto

O4 - HKLM\..\Run: [EasyMode] "%ProgramFiles%\\ASUS\\Easy Mode\\Easy Mode.exe" --limitedUserImportRegister

O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [AsusACPIServer] C:\Programmi\EeePC\ACPI\AsAcpiSvr.exe

O4 - HKLM\..\Run: [AsusEPCMonitor] C:\Programmi\EeePC\ACPI\AsEPCMon.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [SynAsusAcpi] %ProgramFiles%\Synaptics\SynTP\SynAsusAcpi.exe

O4 - HKLM\..\Run: [FlashGuard] "C:\Programmi\FlashGuard\FlashGuard.exe" -run

O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [OrderReminder] C:\Programmi\Hewlett-Packard\OrderReminder\OrderReminder.exe

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [PersistenceThread] C:\WINDOWS\system32\PersistenceThread.exe

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [ISW] "C:\Programmi\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [SRS Premium Sound] "C:\Programmi\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe" /hideme

O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: BTTray.lnk = ?

O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Invia a Bluetooth - C:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O8 - Extra context menu item: Invia a periferica &Bluetooth... - C:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\policylsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\policylsp.dll

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: igdlogin - igdlogin.dll (file missing)

O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Avira AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Programmi\CheckPoint\ZAForceField\IswSvc.exe

O23 - Service: privoxy - The Privoxy team - http://www.privoxy.org - C:\Programmi\Privoxy\privoxy.exe

O23 - Service: SRS Volume Sync Service (SRS_VolSync_Service) - SRS Labs, Inc. - C:\Programmi\SRS Labs\SRS Premium Sound\SRS_VolSync.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe



--

End of file - 10135 bytes

Grazie in aticipo e buon 2010!

[crazy.cat]

La colpevole è questa dll.

O10 - Unknown file in Winsock LSP: c:\windows\system32\policylsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\policylsp.dll

Usa lspfix come in questa discussione precedente sicurezza/policylsp-dll-t58095.html
Se non ti spiace,prova a caricare la dll sul sito di virustotal per farla analizzare per vedere se è cambiato qualcosa.
Oppure se puoi caricarmi il file su questo sito http://www.wikifortio.com/ e darmi il link per scaricarlo che poi ci guardo io di cosa si tratta.

[MirrorHole]

Grazie di tutto crazy.cat!
Ma hanno portato via il portatile a riparare senza avvisarmi quindi resterò con questo dubbio!

[MirrorHole]

Scusate ma riapro la discussione!
Li non ci hanno capito nulla!

Ho provato ad utilizzare LSPfix ma non riscontra nessun problema ...quello che rileva sono le seguenti dll:
mswsock.dll (Descrizione: TCP)
winrnr.dll (Descrizione: NTDS)
PolicyLSP.dll (Descrizione: Protocol Handler)
Rsvpsp.dll (Descrizione: Protocol Handler)

VirusTotal non rileva nulla :

Antivirus Versione Ultimo aggiornamento Risultato
a-squared 4.5.0.46 2010.01.04 -
AhnLab-V3 5.0.0.2 2010.01.02 -
AntiVir 7.9.1.122 2009.12.31 -
Antiy-AVL 2.0.3.7 2010.01.04 -
Authentium 5.2.0.5 2010.01.04 -
Avast 4.8.1351.0 2010.01.03 -
AVG 8.5.0.430 2010.01.04 -
BitDefender 7.2 2010.01.04 -
CAT-QuickHeal 10.00 2010.01.04 -
ClamAV 0.94.1 2010.01.04 -
Comodo 3464 2010.01.04 -
DrWeb 5.0.1.12222 2010.01.04 -
eSafe 7.0.17.0 2010.01.03 -
eTrust-Vet 35.1.7214 2010.01.04 -
F-Prot 4.5.1.85 2010.01.03 -
F-Secure 9.0.15370.0 2010.01.04 -
Fortinet 4.0.14.0 2010.01.02 -
GData 19 2010.01.04 -
Ikarus T3.1.1.79.0 2009.12.31 -
Jiangmin 13.0.900 2010.01.04 -
K7AntiVirus 7.10.936 2010.01.02 -
Kaspersky 7.0.0.125 2010.01.04 -
McAfee 5850 2010.01.03 -
McAfee+Artemis 5850 2010.01.03 -
McAfee-GW-Edition 6.8.5 2010.01.04 -
Microsoft 1.5302 2010.01.04 -
NOD32 4741 2010.01.04 -
Norman 6.04.03 2010.01.04 -
nProtect 2009.1.8.0 2010.01.04 -
Panda 10.0.2.2 2010.01.03 -
PCTools 7.0.3.5 2010.01.04 -
Prevx 3.0 2010.01.04 -
Rising 22.29.00.04 2010.01.04 -
Sophos 4.49.0 2010.01.04 -
Sunbelt 3.2.1858.2 2010.01.03 -
Symantec 20091.2.0.41 2010.01.04 -
TheHacker 6.5.0.3.131 2010.01.04 -
TrendMicro 9.120.0.1004 2010.01.04 -
VBA32 3.12.12.1 2010.01.04 -
ViRobot 2010.1.4.2120 2010.01.04 -
VirusBuster 5.0.21.0 2010.01.03 -
Informazioni addizionali
File size: 479744 bytes
MD5 : a39917b6aec94a4f4316a90e14a274dd
SHA1 : e5927bbf521d229e5e9c91be1b17917b14ef2584
SHA256: 4aa1b82e17ffd27a812ff327becf012ef4c95f56f975a77cf08e7b70c230d10c
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x2DADC
timedatestamp.....: 0x49A7136E (Thu Feb 26 23:10:54 2009)
machinetype.......: 0x14C (Intel I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.textbss 0x1000 0x2B931 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.text 0x2D000 0x5B4B1 0x5B600 5.62 22cc9460fbd2ca99f50de5a0b3d492be
.rdata 0x89000 0x12023 0x12200 3.80 ea2f1dcc67fe689f13820ef05ec8a9da
.data 0x9C000 0x389C 0x1600 2.14 ca12983be716b8f4e643e8e1dae5899e
.idata 0xA0000 0xF1D 0x1000 4.42 a856d652b24ffd6f1080ec6b75152392
.rsrc 0xA1000 0xC09 0xE00 1.13 262ea041501ed9ad12107c54f6e38bfd
.reloc 0xA2000 0x413B 0x4200 6.23 8b1a477c373809c1f41170d5c28de8b6

( 4 imports )

> kernel32.dll: Sleep, CompareStringW, CompareStringA, FlushFileBuffers, CreateFileA, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, GetConsoleMode, LeaveCriticalSection, OutputDebugStringA, EnterCriticalSection, GetCurrentProcessId, GetLastError, HeapAlloc, HeapFree, HeapCreate, HeapDestroy, InitializeCriticalSection, DebugBreak, GetProcAddress, LoadLibraryA, ExpandEnvironmentStringsA, WideCharToMultiByte, LoadLibraryW, ExpandEnvironmentStringsW, DeleteCriticalSection, FreeLibrary, CloseHandle, GetCurrentProcess, GetConsoleCP, SetFilePointer, GetTimeZoneInformation, GetCurrentThreadId, GetCommandLineA, IsDebuggerPresent, RaiseException, MultiByteToWideChar, lstrlenA, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, RtlUnwind, TlsGetValue, GetModuleHandleW, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, InterlockedDecrement, GetCurrentThread, HeapValidate, IsBadReadPtr, SetEnvironmentVariableA, ExitProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, GetProcessHeap, GetModuleFileNameW, VirtualQuery, FatalAppExitA, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, HeapSize, HeapReAlloc, VirtualAlloc, WriteFile, SetConsoleCtrlHandler, InterlockedExchange, InitializeCriticalSectionAndSpinCount, WriteConsoleW, OutputDebugStringW, GetTimeFormatA, GetDateFormatA, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, LCMapStringA, LCMapStringW, GetLocaleInfoW
> psapi.dll: GetProcessImageFileNameA
> user32.dll: wsprintfA, wvsprintfA
> ws2_32.dll: -, -, -, -, WSCGetProviderPath, WSCEnumProtocols

( 1 exports )

> GetLspGuid, WSPStartup
TrID : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: 12288:k9SeUiDiXbNu4V7FSxRlU3yeK0TTrNM7X5CjQu4PX:2SeUiDijMp1z0TlMtCjQuk
PEiD : -
RDS : NSRL Reference Data Set
-

Ho uplodato anche il file PolicyLSP.dll:
PolicyLSP.dll

Grazie a crazy.cat e a tutti gli altri!

[crazy.cat]

Devi mettere il flag nella casellina che dice che sai cosa stai facendo, poi sposti la dll PolicyLSP.dll (Descrizione: Protocol Handler) nella finestra a destra e confermi la rimozione.

[MirrorHole]

Grazie crazy.cat! Problema risolto!