Computer behaving poorly

[Guest]

bump

[guestolo]

Can I see a new hijackthis log, I want to check on something
Also, are you running directly thru a  modem or are you hooked up thru a router?

Could you go to START>>Run
Copy and paste the bold to the open field

regsvr32 softpub.dll

Close down all browser windows then hit OK

[BillP]

I am hooked up to a router.  File you requested I run succeeded.
and I could not post this on my own computer again.

Here's my new log:
ogfile of HijackThis v1.99.1
Scan saved at 11:29:28 PM, on 9/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\system32\lexpps.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Intuit\QuickBooks\Components\QBAgent\qbdagent2002.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.crosswalk.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks\Components\QBAgent\qbdagent2002.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Documents and Settings\Jessica\programs\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP...l_v1-0-3-17.cab
O16 - DPF: {4E7BD74F-2B8D-469E-DEFA-EB76B1D5FA7D} - http://www.ez-tracks.com/downloader/cab/special/eztdl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller Class) - http://h30155.www3.hp.com/ediags/gs/instal...edsolutions.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/...tiveXPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon.net/update/msnwebinsta...es/vzWebIns.CAB
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?325
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[guestolo]

I'm stumped,  I thought they may of been some leftovers from Symantecs'
But nothing related from I can see
Can you try something else please

Run Hijackthis again with all other windows closed and fixed checked the follow entry
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1

Restart your computer
Run another scan with hijackthis and make sure it's not there

How is everthing
I don't want you running without AV for too long

If the above doesn't help, can you connect this computer directly into the modem
Bypassing the Router
Can you then connect to the sites?

[BillP]

Did the HiJack This and fixed the entry you requested.

Tried some sites and they still hang.

Attempting to post here now.

[BillP]

Okay that worked -  Posting here.

::::::If the above doesn't help, can you connect this computer directly into the modem Bypassing the Router Can you then connect to the sites?::::::

How do I do that? Would love to try it.

BillP

[BillP]

Thought I would mention - have another computer on same router and do not experience the same problems there.  Email works does not hang on sites etc.

I ran a repair on Outlook no change.
I used a different port on the router no change.
I have spent hours on the phone with thechies from my ISP trying to figure why mail own't send and it hangs on the site they try to get me too.

Any suggestions?

I should download AVG now shouldn't I?  Don't want to risk it anymore.  I ran a TRend Micro scan and was clean, however.

Billp

[guestolo]

Ues please, install AVG and run a full scan after updating

Let's try this
Go into your Internet options
Privacy tab
Are you set to Medium?

What email client are you using
Outlook or Outlook Express
also the email you are having problems with
Is it something like Hotmail or an ISP account
If ISP, which one?

When you uninstalled SP2 everything worked OK?

A site your having problems with
Have you tried adding it to your trusted sites in Internet options under Security tab

[BillP]

Privacy tab set to medium
Problem sites are in trusted sites
I use Outlook other family members use Express.
ISP email - Verizon  
When I uninstalled reinstalled SP2 it worked for about a day.

Going to install AVG now......

Thanks for your help

[BillP]

Bump

[BillP]

bump again

Installed AVG

[guestolo]

I take it AVG found nothing and your still having problems

I'm just on my way to work, I have a couple more ideas
just don't have time right now
Your using Verizon DSL??
Right?

We could try changing your MTU settings and see if that helps

But I would first still, try shutting down your computer
Disconnect the router and connect directly into the modem
Restart back up and see if you can access the sites
It would help to identify if it is a router setting
Connection to modem is pretty straight forward
I'll be back later

[BillP]

Right AVG found nothing.

I use Verizon FiOS  (Fiber Optic)  I only have a router - no modem.  The FiOS enters the house to a small outlet like box behind my desk, a CAT-5e cable D-link runs from outlet to router and the same cables run from router to computers.  I put the cable from the wall/outlet directly into the computer and I have no connection at all - homepage does not open.

[guestolo]

I use Verizon FiOS (Fiber Optic)

I believe that you must set MTU to 1492, as you should be set as PPPoE

Can you do me a favor
Navigate to the following page
Click HERE?

Not including IP address, can you copy and paste the info from that page
From TCP options string and down

It's just a hunch, I'm just checking on something

[BillP]

TCP options string = 020405ac01010402
MTU = 1492
MTU is optimized for PPoE DSL broadband. If not, consider raising MTU to 1500 for optimal throughput.
MSS = 1452
MSS is optimized for PPPoE DSL broadband. If not, consider raising MTU to 1500 for maximum throughput.
Default Receive Window (RWIN) = 65535
RWIN Scaling (RFC1323) = 0 bits
Unscaled Receive Window = 65535

Note: Under Windows 9x, if you have RWIN set to any other value, and the Analyzer reports 65535 you might need to install the MS Vtcp386 fix.
For optimum performance, consider changing RWIN to a multiple of MSS.
Other values for RWIN that might work well with your current MTU/MSS:
511104 (MSS x 44 * scale factor of
255552 (MSS x 44 * scale factor of 4)
127776 (MSS x 44 * scale factor of 2)
 63888 (MSS x 44)
bandwidth * delay product (Note this is not a speed test):

Your RcvWindow limits you to: 2621.4 kbps (327.675 KBytes/s) @ 200ms
Your RcvWindow limits you to: 1048.56 kbps (131.07 KBytes/s) @ 500ms
MTU Discovery (RFC1191) = ON
Time to live left = 123 hops

TTL value is ok.
Timestamps (RFC1323) = OFF
Selective Acknowledgements (RFC2018) = ON
IP type of service field (RFC1349) = 00000000 (0)

[guestolo]

Well, Mtu is set ok
For my info, we tried Winsockfix, checked hosts file from another thread

I'm reaching but try the following

Go to START>>RUN>>in the open field
copy and paste the following in bold

iexplore /rereg

Close down IE before hitting the OK button

Restart your computer
Any help?

Maybe someone else has an idea?