I can browse but cant download

[canadian69]

I am stumped on this one, next step is to wipe the PC.

So I cant browse the net no issues, but can't download any files.
I have scanned with combofix, symantec endpoint, malwarebytes, all clean (had to copy these over from another PC)
This happens in all profiles and in safemode /w networking as well
Was able at one point to download some windows updates, but am stuck on 4 updates now that refuse to download and install
tried downloading microsoft fixit, no go
tried downloading hijackthis from filehippo, no go
tried these in both IE8 and Firefox (in firefox the download window comes up, but never progresses beyond "starting")
I have checked all running processes, nothing seems out of the ordinary
I think this machine had AVG on it at one point, tried to download the AVG remover , no luck there
I checked the host file and reset all internet options to default, problem persists.

This really has the feel of some piece of interfering malware, but I can't find anything. I was able to update the definition files for symantec, which is an application controlled process, rather than a browser based download, so there is a hint there I guess.

If anyone has any suggestions please feel free.

edit: have run sfc /scannow, winsock fix and re-registered DLL's. still same, however HAVE discovered that it is ONLY EXE files I can't download. ISO/RAR etc all work regardless of size. So to revise issue, it's only EXE files (afaik) that do not download.

 

[katfishgr]

i was the one on yahoo answers trying to assist ...

without sitting there at the pc and poking around through things, i'm just about out of ideas ... did you already scan with Hitmanpro from surfright.nl?

and already check the other POLICIES in the registry as well that i mentioned? aside from the scanwithantivirus one ... might find an eroneous entry in POLICIES under network or one of the other folders possibly.

 

[canadian69]

I checked the policies in the reg, haven't run hitman, but with everything else I have run I doubt it would do anything, plus I can't download it on the problem computer anyway, I would have to copy it over. I may entertain it later. Nothing out of wack in the services either. I am looking at security policies as a potential problem, but XP home doesn't appear to have secedit cmd. Cant find any indication of a group policy file either.

Gonna d/l HTP and Internet download manager and see if either works or functions as a work around.

 

[canadian69]

Created a new profile / admin still same issue. cant find anything in the registry HKLM/Software/policies not to say something couldn't be hiding in there though. Ran registry cleanups with ccleaner and avgtuneup.

Installing IDM, does work around the issue, was able to download a sample exe (vlc player from filehippo).

This is one crazy weird issue. I've worked in IT for 18 years, typically I don't get stumped like this, but its a friends (old) computer and I would like to find the answer rather than wipe it on them. I somehow never get paid for these difficult to resolve problems, lol.

 

[canadian69]

Oh, Hitman Pro came up with some cookies only.

 

[katfishgr]

A stand alone download manager may suffice. I'll check back later to see what you found with that.

 

[katfishgr]

can you email me a HJT log? chuck at nbrepairs dot com.

 

[canadian69]

HJT Log:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\trend micro\HiJackThis\HiJackThis.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1327161236687
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\Browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\Browseui.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

 

[katfishgr]

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll


You have a need to have Netware? If not remove it. Not that this will solve your issue, but just one of those OCD things for me lol. Remove Netware from the network properties of you adapter.

Don't really see much else. Did you give that stand alone downloader a go? I see it listed above.