Sorry your browser is not supported!

My computer has been slow lately... I've run AVG Anti-Spyware and AdAware, they cleaned up quite a bit of junk, but there doesn't seem to be any left. But my computer is still running slow and looking at my network connections, it looks like I'm sending and recieving hundreds of packets a send. Within a few hours I've sent and recieved over a million packets, even if I'm not surfing the web, using MSN, etc.

I'm at a loss as to what to do here. AVG says I have hundreds of connections open, even when I'm not using the internet. I'm guessing that's not normal?

Help?

spybot search and destroy is a very good spyware removal tool.

update it
run it and then check the advanced tab
activate SDhelper and TeaTimer.
activate the block hosts file twice


after that download hijackthis and post us the log.

Alright, did that. Spybot S&D got rid of tons of crap I had on here, but there're still packets being sent and recieved like mad. Here's the HijackThis log file. Thanks for your help!

Logfile of HijackThis v1.99.1
Scan saved at 10:01:00 PM, on 12/3/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RioMSC.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_12\bin\jusched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\tbctray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Izzys\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Blingo Toolbar Helper - {CD860DEB-B4A7-4B80-8B06-4F275E778340} - C:\Program Files\Blingo Toolbar\blingobar.dll
O3 - Toolbar: Blingo Toolbar - {EEE1A699-C438-486B-8B23-347A37F77328} - C:\Program Files\Blingo Toolbar\blingobar.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_12\bin\jusched.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\System32\tbctray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_12\bin\npjpi142_12.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_12\bin\npjpi142_12.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.11) - http://gameadvisor.futuremark.com/global/msc311.cab
O16 - DPF: {E3E02F12-2ADB-478C-8742-5F0819F9F0F4} (Quantum Streaming IE VersionManager Class) - http://qmedia.xlontech.net/100170/sdk/latest/qsp2ie06041001.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D27CE32-4C75-497F-9FAF-BE973BD1D8AA}: NameServer = 85.255.115.54,85.255.112.232
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.54 85.255.112.232
O17 - HKLM\System\CS1\Services\Tcpip\..\{8D27CE32-4C75-497F-9FAF-BE973BD1D8AA}: NameServer = 85.255.115.54,85.255.112.232
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.54 85.255.112.232
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing)
O21 - SSODL: DCOM Server 3339 - {2C1CD3D7-86AC-4068-93BC-A02304BB3339} - C:\WINDOWS\system32\iwpng.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe

ok some things straight away that i can see could pose a threat. Always google them if they are part of your Operating System setup.
Dont install toolbars of any kind before finding out if they are spyware.

Your getting close to removing a lot of junk out of your system.

Spybot Search & destroy will remove most of it within the advanced setup area
look under startup items or something similar.


Check these things against google, if not spyware keep them for system health.

Thanks for the help Indi.

After doing all you've suggested my computer and internet is running quite a bit faster, and there are no longer hundreds of connections being made according to AVG, just the regular ones needed by my applications.

The only strange thing is that I'm still sending and recieving 100-200 packets a second even if I'm not browsing the internet or using any internet applications.

Hey, no problems, glad to help, A lot of clients I have, have machines far worse with spyware etc..

perhaps the SQL setup in your machine is running and sending packets?
Something network wise in your machine is causing it.

keep probing around and it will dawn on you what's causing it.

could be something new? i found a virus on my friend pc that wasnt identified by any scanners. it took us 2 hours to remove it manually. a good idea is to look around your pc for any files with strange names. we found the file location cause it was running under processes for your instance, it might be a bit harder, because everything you have under process looks fine.

well, wish you luck cleaning up ur pc... its a nasty business

I spent around 3 hours yesterday sorting out a friend of a friend's two pc's that were infected with the Zlob spyware. It constantly popped up messages and applications claiming to find viruses on the pc and you should pay up to remove them!

Adaware kept claiming it removed it but it kept coming back. Spybot sorted everything out though. Quite a nasty bit of spyware apparanlty as it downloads other spyware, slows down the pc and keeps popping up windows all over the place.

The new AVG spyware program looks interesting but the resident scanner is only effective during the 30 day trial.

The TeaTimer mode in Spybot looks far more interesting though as it will protect you for free with no time limits.

Just remember, if in doubt, there aint nothing like a good old reformat and reinstall. Obviously you need to spend time backing up before hand, and it'll take a good half a day normally (reformatting, installing, downloading drivers again etc.), but once you've done it, ya compo is reborn.

Zlob, heh I had something similar with a neighbor, they claimed to have excellent computer skillz, after i removed about 800 components, they rethought about there ubeh status. lol
Then he reformatted and put his machine online without any protection, I hazard a guess at 4 minutes with another infection with a similar thing. heh live n learn.

It also didn't help that their main PC is shared between 5 different family members and kids just click anything that comes up on screen saying you need to install xyz to play a game or watch a video. Then they tried to fix it themselves by installing all sorts of antivirus, antispyware, firewalls, etc and the pc was just a jibbering wreck.

Agree with Fallout that a reformat every couple of years is the best thing for any pc. Yes it's a big hassle reinstalling stuff but what a difference it can make.

I setup user accounts for my clients and friends.
It prevents a lot of hassles when spyware gets total control of the system.
I always make one for myself as admin, hence i get the job back and can repair it from Admin.

The only sure way to defeat this annoyance, is to backup your vital data, and format your PC. Upon fresh installation, be sure to install anti-virus tools, anti-spyware and of cause a good firewall. Refrain from installing the vast majorty of free software from the internet, espically tool bars. Be sure to check that the software you do install, claims at least, to be spyware free.

I think that's a good tip. Only download and use those things that are absolutely essential, including browser plugins etc. Don't download and install stuff just cos it might be cool, or allow 10 plugins from a website so that you can play 1 flash game that you think might be slightly entertaining. Always click NO and CANCEL on pop-ups unless you know what they are. Always block all connections made by your firewall unless they seem directly related to what you're doing, and then dont check the "Always Allow" button, unless its on something you know needs to contact the net all the time (an online game, a messenger program etc.). Avoid warez, serial sites etc and never click links that could be to a dodgy location (if you have to, set your security to maximum first).

I think if you're just paranoid about things, you think of your compo as very vulnerable, and treat all software/apps as potentially harmful and suspicious, you do alright.

I haven't had a virus or anything remotely significant on this compo sinse my last install (around 8 months) ago, and I put that down to my internet habbits and the care I take with what I download.

Think ive mentioned this before but try renaming the hijack this executable to something different before you run it, as some processes manage to hide themselves from its scan.

Far too complex. Reformat, change basic internet habbits. Best thing to do in this case. As Fallout said, if you don't accept it and install it, it can't hurt you. I must admit my laptop is quite heavily infected with this stuff because I download alot of shareware and other applications. However it is isolated from the rest of my network, save for direct internet connection, and I never do anything remotely important on it. My desktop however is used for internet banking, home shopping and other sensitive sites, and information is stored on it's drive. On that thing I've got nVidia's hardware firewall installed, the firewall on the router setup, microsofts anti-spyware, which seems to do the job, plus Macaffe anti virus. I'm also protect by AOL's anti-spyware software. I never install anything on that machine unless I've screened it on the laptop, and I never, ever allow Active X, java or flash to download onto the machine, nor do I install any plugins. It is a bit limiting sometimes, but hey, that's why I setup my laptop to act as the plage system.

formatting is the last resort obviously, changing your methods is clearly the way to use WIndows.
Save the fun stuff for mac os x until the day we have to do similar things.

Yea, I don't think I'm going to bother reformatting, too much bother reinstalling the stuff I'll be using. I plan on buying a whole new PC in a few months anyways, this one is on it's way out as it is.

There is your problem...

Personally, I say that you are loading too much at boot. I don't know your system, but I keep my log shorter then the output screen, removing anything that does not NEED to load. (I KNOW what the software is, do not comment on that.)

I would say that none of this needs to load. It either is a worthless BHO. An automated update service (and before you argue... most software apps automatically check when they run. No reason for the background program.) Pre-loader, control pannel, or addition to the tools menu. You probally will want to check me up, but I think the majority is useless (And yes, your ipod will work without the ipodservice).


O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Blingo Toolbar Helper - {CD860DEB-B4A7-4B80-8B06-4F275E778340} - C:\Program Files\Blingo Toolbar\blingobar.dll
O3 - Toolbar: Blingo Toolbar - {EEE1A699-C438-486B-8B23-347A37F77328} - C:\Program Files\Blingo Toolbar\blingobar.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_12\bin\jusched.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\System32\tbctray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_12\bin\npjpi142_12.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_12\bin\npjpi142_12.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)


Something I find interesting, however, is you seem to have Microsoft SQL Server... HJT records it as 'missing' but the service is still there.

These are things that I don't fully know what they are... but probally aren't needed (Don't just remove on a whim... If I knew your system I could tell you specifically (mainly because I have a 'pre' log before anything else...)


O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.11) - http://gameadvisor.futuremark.com/global/msc311.cab
O16 - DPF: {E3E02F12-2ADB-478C-8742-5F0819F9F0F4} (Quantum Streaming IE VersionManager Class) - http://qmedia.xlontech.net/100170/sdk/latest/qsp2ie06041001.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D27CE32-4C75-497F-9FAF-BE973BD1D8AA}: NameServer = 85.255.115.54,85.255.112.232
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.54 85.255.112.232
O17 - HKLM\System\CS1\Services\Tcpip\..\{8D27CE32-4C75-497F-9FAF-BE973BD1D8AA}: NameServer = 85.255.115.54,85.255.112.232
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.54 85.255.112.232
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: DCOM Server 3339 - {2C1CD3D7-86AC-4068-93BC-A02304BB3339} - C:\WINDOWS\system32\iwpng.dll (file missing)


And THIS... is a trojan
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing)

A note... ANY time windows notify is invoked there is a very large chance of the dll being run being a virus or other malicious software.

And NO, that instance of AVG is redundant... the 'gaurd' runs in another command




'

It's McAfee (Rather easy with it being in the system tray and all).

But, you really over do it. Put it this way, I am using IE7 customized my security settings and disabled MHTML. For my firewall, I use McAfee and keep it at 'Tight Security' but that is about it (a few other patches and spybots 'immunity'). I have yet to recieve a single piece of spyware that I did not purposly let through... and even if I do install it, I have a program which records the changes after the installation, allowing a swift and easy removal.