Slow Internet Speed

Chucky

Hey,

I consider myself to be quite handy when it comes to a computer. Indeed I have battled many virus and spyware attacks on my PC in the past and have won. This time however, I am lost. My processor is running smoothly, but when i connect to the Internet the download rate is severely depleated. The only other difference I can notice is the dialup box that appears when you open IE. It takes much longer than usual to appear, as if something else is running in the meantime.


Also, I am a very neat person and that's no different with my PC. I can confidently say that I know every directory on my PC and have a rough idea what it's for. I can find nothing out of the ordinary though in this case. I even did a search to find files created within the past few days that the problem has arisen and there is nothing malicious looking. The computer isn't downloading anything in the background according to the standard Windows download meter that appears on the bottom-right when connected.


I use Éircom wireless broadband. I have updated virus checkers and anti-spyware programs and none can detect anything.


I have pasted a copy of a Hijack-This log. i can't see anything unusual in it - Can anyone else?


Logfile of HijackThis v1.99.0
Scan saved at 07:16:41, on 15/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\ams_ii\hndlrsvc.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\ams_ii\iao.exe
C:\WINDOWS\system32\cba\xfr.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\bcmwltry.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.geocities.com/kev_blighe/
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [bcmwltry] bcmwltry.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112887839638
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = KB
O17 - HKLM\Software\..\Telephony: DomainName = KB
O17 - HKLM\System\CCS\Services\Tcpip\..\{B910DE65-1A1A-4C7F-A4FD-A95C9DB02877}: NameServer = 159.134.237.6 159.134.248.17
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = KB
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Intel Alert Handler - Intel® Corporation - C:\WINDOWS\system32\ams_ii\hndlrsvc.exe
O23 - Service: Intel Alert Originator - Intel® Corporation - C:\WINDOWS\system32\ams_ii\iao.exe
O23 - Service: Intel File Transfer - Intel® Corporation - C:\WINDOWS\system32\cba\xfr.exe
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\system32\IomegaAccess.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SecuROM User Access Service (V7) - Unknown - C:\WINDOWS\system32\UAService7.exe
O23 - Service: ZipToA - Iomega Corporation - C:\WINDOWS\system32\ZipToA.exe

odie

Download & Run Ewido security suite (14 day trial).....Update signature file before running

Run it in Safe mode - It found everything that spyware and AV Progs could not on my PC and some others friends had issues with.

Ewido can be found here - http://download.ewido.net/ewido-setup.exe

Sig file here - http://download.ewido.net/ewido-signatures-full-20050615.exe

IDUBasher

First suggestion, get firefox www.getfirefox.com is small, only 4.5mb if I recall and imo much better than IE.

if you don't wanna do that,

check under IE connection settings for the option "automatically discover proxy settings". I've seen this option add 20+ seconds to connecting to websites.

Chalk

Chucky wrote:

Logfile of HijackThis v1.99.0
Scan saved at 07:16:41, on 15/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\ams_ii\hndlrsvc.exe
C:\WINDOWS\system32\ams_ii\iao.exe
C:\WINDOWS\system32\cba\xfr.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\bcmwltry.exe

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [bcmwltry] bcmwltry.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = KB
O17 - HKLM\Software\..\Telephony: DomainName = KB
O17 - HKLM\System\CCS\Services\Tcpip\..\{B910DE65-1A1A-4C7F-A4FD-A95C9DB02877}: NameServer = 159.134.237.6 159.134.248.17
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = KB

some of those i dont recognise,
so id check them out if i were you,

mainly what i see here is something thats changing your tcp/ip setup.
id remove the ones in bold, unless they are specific network settings your supposed to use.
and check your tcp/ip stack to make sure theres nothing unusual

Chucky

Chalk wrote:

some of those i dont recognise,
so id check them out if i were you,

mainly what i see here is something thats changing your tcp/ip setup.
id remove the ones in bold, unless they are specific network settings your supposed to use.
and check your tcp/ip stack to make sure theres nothing unusual

I was worried about them too but if I delete them they return at next startup. I looked up on the WWW about the registry path that they exist at and all forums say that they're normal. It's used by the ISP. However, I was slightly worried that...ok, you know the way I said that when I open IE the dial-up box takes a while to load? I was worried that something was altering where i was actually dialing to....


...ye all remember that case a while ago in England about the guy whose connection was hijacked and each time he dialed in he was connecting to some African nation.


Firefox - I downloaded it and never liked it. I've been using IE all my life. But believe me, if Firefox sorted my problem I'd be using it


I'll try the Ewido Security Suite later tonight because right now, i'm late for work


Thanks guys, really appreciate the responses.

Cabaal

Chucky wrote:

Firefox - I downloaded it and never liked it. I've been using IE all my life. But believe me, if Firefox sorted my problem I'd be using it

The chances of your pc having spyware/adware installed while browsing would be far less if you used a better browser,

lampsie

you've probably done is already, tried firing up 'msconfig' and looking for odd startup programs?

- lampsie

dark_prince

You said you were using eircom broadband, so modem hijacking would not be an issue as this only happens on dial-up where you physically dial a number to connect and the programs were changing this number to premium numbers in random countries

AdMMM

In your internet options check the option "Never Dial A Default Connection". This means you won't have your dial up prompt popping up. Might not be fixing the problem, more like sweeping it under the carpet...

Chucky

I got the problem sorted. I'm not sure what fixed it exactly. I was running Ewido and it was finding some viruses in the Windows directories but at the same time I was fiddling with the firewall settings. I'm not sure which improved the Internet speed but in any case it's back to normal.

Case closed.

Thanks lads