networking and slow loading pages

[jacwat]

Not sure if I am in the right place but here goes.........

Please can anyone help, my laptop is really not doing what I hoped it would, I have two problems:

 

1. First and most important, suddenly it will not connect to the LAN (this has only started happening tonight). If I sit in the window (most uncomfortably!) I can connect to the pub next door. This is not satisfactory as the signal strength is very weak. I usually have a wireless connection to my router which I know is OK because the desktop is working just fine. Can anyone walk me through solving this problem please. (Bear in mind it will connect to the pub but not to the router at home)

 

2. When I am surfing, the pages are loading painfully slowly (this has been happening long before problem 1.) I do have anti-virus (AVG) and firewall (Zone Alarm). So unless some nasty has slipped through the net, is there any way of tweaking the machine? It's been like this for weeks.

Any help would be gratefully received (simple terms please!)

Thank you in advance,

Jackie

 

(ASUS EEE 904HD XP)

[maynardvdm]

Hi

 

This might be malware related.

 

Please do the following so that our malware expert can have a look:

 

Please download the latest version of HijackThis from Trend Micro and save it to your desktop.

 

• Download HJTInstall.exe to your desktop.
  
• Doubleclick HJTInstall.exe to install HijackThis.
  
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
  
• Click on Install.
  
• It will create a HijackThis icon on the desktop.
  
• Once installed, it will launch Hijackthis.
  
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in Notepad. Include this log in your next reply.
  

 

Notes:

Do not use the AnalyseThis button, its findings are dangerous if misinterpreted.

Do not have Hijackthis fix anything yet. Most of what it finds will be harmless, or required for your computer to run like it should.

[jacwat]

log of hijackthis

 

thank you for your reply here it is....do hope you can see something fixable

regards Jackie

 

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:33:12, on 17/11/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\AVG\AVG9\avgemc.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\EeePC\ACPI\AsTray.exe

C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\EeePC\ACPI\AsEPCMon.exe

C:\WINDOWS\system32\igfxext.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Elantech\ETDCtrl.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\PROGRA~1\AVG\AVG9\avgtray.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Asus\EeePC\Super Hybrid Engine\SuperHybridEngine.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = ASUSTeK Computer

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [AsusTray] C:\Program Files\EeePC\ACPI\AsTray.exe

O4 - HKLM\..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe

O4 - HKLM\..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe

O4 - HKLM\..\Run: [egui] "egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\alan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: SuperHybridEngine.lnk = ?

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe

O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

End of file - 7268 bytes

[jacwat]

the network problem

 

Hi

Today I think I have sorted the network problem. After much messing around pinging and looking at IP and gateway addresses, I unplugged the router for a while and so far it's been ok, have no idea why this should have suddenly been a problem for no apparent reason. However I do still have the slow loading pages problem, in fact it seems to be getting worse. I also have Google chrome which is terrible too at the moment. I can watch TV programmes on the laptop with no problems at all...that is after waiting a lifetime for the main page to open!

Regards Jackie

(Hope the log of Hijackthis will reveal something which can be cured)

[maynardvdm]

Hi

 

I am going to move this to the malware section until cleared by our expert.

[chiaz]

I see nothing wrong with your HijackThis log Jacwat, but it is not a thorough scanner.

 

Let's have you go HERE to run Panda ActiveScan 2.0

• Click the big green Scan now button
  
• If it wants to install an ActiveX component allow it
  
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  
• Once the scan is completed, please hit the notepad icon next to the text Export to:
  
• Save it to a convenient location such as your Desktop
  
• Post the contents of the ActiveScan.txt in your next reply.

[jacwat]

Results of the scan

 

;***********************************************************************************************************************************************************************************

ANALYSIS: 2009-11-21 18:27:18

PROTECTIONS: 1

MALWARE: 12

SUSPECTS: 0

;***********************************************************************************************************************************************************************************

PROTECTIONS

Description Version Active Updated

;===================================================================================================================================================================================

AVG Anti-Virus Free 9.0 Yes Yes

;===================================================================================================================================================================================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===================================================================================================================================================================================

00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\documents and settings\alan\cookies\alan@doubleclick[2].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\documents and settings\alan\cookies\alan@atdmt[1].txt

00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No c:\documents and settings\alan\cookies\alan@tradedoubler[1].txt

00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No c:\documents and settings\alan\cookies\alan@mediaplex[1].txt

00167704 Cookie/Xiti TrackingCookie No 0 Yes No c:\documents and settings\alan\cookies\alan@xiti[1].txt

00168061 Cookie/Apmebf TrackingCookie No 0 Yes No c:\documents and settings\alan\cookies\alan@apmebf[1].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\alan\cookies\alan@serving-sys[1].txt

00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\alan\cookies\alan@bs.serving-sys[2].txt

00168106 Cookie/Weborama TrackingCookie No 0 Yes No c:\documents and settings\alan\cookies\alan@weborama[1].txt

00169190 Cookie/Advertising TrackingCookie No 0 Yes No c:\documents and settings\alan\cookies\alan@advertising[2].txt

00207936 Cookie/Adviva TrackingCookie No 0 Yes No c:\documents and settings\alan\cookies\alan@adviva[1].txt

00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No c:\documents and settings\alan\cookies\alan@smartadserver[2].txt

;===================================================================================================================================================================================

SUSPECTS

Sent Location

;===================================================================================================================================================================================

;===================================================================================================================================================================================

VULNERABILITIES

Id Severity Description

;===================================================================================================================================================================================

206981 HIGH MS09-007

;===================================================================================================================================================================================

[jacwat]

Hi Chiaz

 

Thank you for your help, the results to the scan are in the post above, looks like some tracking cookies are these a problem?

 

Two nights ago I was looking at my emails (I get a lot to do with my work) most contain several attachments for me to open. When I have finished with these I delete them. I was having a clear out of all the folders in my email place and when I looked in the sent folder (which I never go into) I found over 2000 emails in there! I deleted these at once. Now since then this laptop seems to be performing faster, though still not perfect. I still get some pages that I give up on because they don't load but overall it's much better.

 

Can a lot of emails slow your computer? It seems a bit crazy to me. I can imagine the pc would be slow on the actual email site if you have too many but surely until you log in to the email site your emails are all in cyberspace and the pc would be normal speed?

 

I look forward to your comments on the email theory and the results of the scan.

 

Many thanks,

Jackie

[chiaz]

Can a lot of emails slow your computer? It seems a bit crazy to me. I can imagine the pc would be slow on the actual email site if you have too many but surely until you log in to the email site your emails are all in cyberspace and the pc would be normal speed?

Yes, I believe this is true.

 

It's time to remove ComboFix.

 

Go to to Start > Run

Type in box

 

combofix /u

 

Note: the space between the X and the /u

 

Press Enter.

 

This command will:

 

Delete the following:

ComboFix and its associated files and folders.

VundoFix backups, if present

The C:\Deckard folder, if present

The C:_OtMoveIt folder, if present

 

Reset the clock settings.

Hide file extensions, if required.

Hide System/Hidden files, if required.

Reset System Restore.

[jacwat]

Hi

I couldn't get that to work, I did note the space between the letters etc... I tried several different ways round it but with no success.

Can you suggest anything else?

Thanks,

Jackie

[chiaz]

I'm sorry, it was my mistake. I did not have you run the above mentioned tool. Well I believe your computer is clean now and you are all set to go unless you want me to get someone to take a look at your remaining problems if any.

[jacwat]

Thank you very much for your help

Regards Jackie