IE6 Balky- HijackThis log

Hi, I have been working try to resolve some IE issues and have the following HijackThis log. Could someone please review it and comment? Thanks a lot!

Lar
-------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:37 PM, on 7/31/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device
Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache
Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache
Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\IE New Window Maximizer\iemaximizer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Print Key 2000\printkey.exe
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Quick ShutDown\qsd.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijack This 2.02\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.thebreastcancersite.com/clickToGive/home.faces?siteId=2
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common
Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer -
{3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program
Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection -
{53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search &
Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -
C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition
Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common
Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows
Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ISUSPM Startup]
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common
Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program
Files\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKCU\..\Run: [IE New Window Maximizer] C:\Program Files\IE New Window
Maximizer\iemaximizer.exe
O4 - Startup: Event Reminder.lnk.disabled
O4 - Startup: Microsoft Office Shortcut Bar.Lnk = C:\Program Files\Microsoft
Office\Office\MSOFFICE.EXE
O4 - Startup: Quick ShutDown.lnk = C:\Program Files\Quick ShutDown\qsd.exe
O4 - Global Startup: Adobe Gamma Loader.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: AutoStart IR.lnk.disabled
O4 - Global Startup: Event Reminder.lnk.disabled
O4 - Global Startup: Microsoft Find Fast.lnk.disabled
O4 - Global Startup: Notify Check.lnk = C:\Program
Files\Lewe\NotifyPlus\Notify.exe
O4 - Global Startup: Office Startup.lnk.disabled
O4 - Global Startup: Printkey.lnk = C:\Program Files\Print Key
2000\printkey.exe
O4 - Global Startup: US Robotics.lnk.disabled
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program
Files\AIM95\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -
C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration -
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search &
Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network
Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment
1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft -
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler
(AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir
PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard
(AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir
PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common
Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program
Files\Bonjour\mDNSResponder.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown
owner - C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache
Software Foundation - C:\Program Files\NVIDIA
Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel
32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program
Files\iPod\bin\iPodService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program
Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program
Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions -
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common
Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions -
C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy
Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions -
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation -
C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: U.S. Robotics Wireless LAN Service (wltrysvc) - Unknown
owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 9315 bytes

 

Hi LarryB,

Your log appears clean. Could you be a bit more specific? What kind of issues are you trying to resolve?

 

My DSL internet connection has become, well... balky! Last week IE and OE started acting up with slow connections, pages timing out, etc. I would watch the Network Connection icon in the systray and the outgoing would blink and incoming would be dead. Sometimes are worse than others. Today seems to be a bit better. I did literally everything to cleanup and tweak up the computer. Followed the MSIE newsgroup recommendations including LSPFix, and I have run tons of scans and cleaners. I now squeek when I walk.

So, as I expected, the HijackThis log is clean. Maybe I will ck the connections at the router and modem next. My pings are good, though. I wonder if its the ISP (via Covad). OE seems to work better but IE is still very spotty. Prob not the ISP then.

 

It seems to be my computer, specifically, IE. After finding no answers that worked, I decided to go the System Restore route. Worked great. Fast as lightening. Once I reinstalled an AV program, it became really slow again. I tried Avira again and then Avast. However, in order to get IE back up to speed, uninstalling through RevoUninstaller was not enough and I would have to System Restore again to the same date to get it back up to speed. Any ideas?

I did uncheck the Enable Third Party Add Ons, but that did not help either.

Thanks, Larry

 

Hi Larry. AVs slowing you down .......... ugghhh! I wouldn't expect that looking at your system specs. Anything else performing poorly that might suggest the problem lies elsewhere, such as maybe failing memory, running a bit warm, fragmented drive, etc? You might consider first running a performance test at PC Pitstop. You might also want to install a free trial of a paid AV, such as Kaspersky or CA, to see if they have the same effect (after uninstalling the freebie of course).

 

I just started to consider hardware issues and I checked all of the cooling fans (did a little dusting while there). I also recently defragged.

I just found out last night that my sister-in-law, who is on the same DSL cat 5e network, has been having the same problems! I reset the Linksys WRT54G v1 Wireless Router (unplugged for 30 secs and the, later, hit the Reset button) and the 2-Wire 1000c Firewall Modem. No change. This new info kind of elimintes the hardware aspect of this one computer. I cannot decide if that points to or eliminates the DSL from suspicion. I also wondered if it was some kind of IE Update so I uninstalled the latest ones going back to July 9, but no improvement there either, so the reinstalled. I am pinging OK and my DSL Reports tests look good.

I also have seen that the picture contents of emails that I get (like Staples, etc) are taking a really long time to load. If I watch the Network Connections icon in the Systray, the outgoing light (bottom one) just blinks for about 20 seconds before the incoming finally comes to life... and slowly at that.

I'll try a PC Pitstop test. Has been a while. Thanks.

 

You said she's on the same dsl network. Do you mean she's connected to your network, or that she has dsl service from the same provider and in the same vicinity? If the latter, it would certainly be an indication of a possible provider issue. Is her configuration similar to your, eg; installed programs, antivirus, firewall, etc?

If you haven't already done so, see what kind of results you get from Speakeasy Speed Test. Check for consistency across locations selected too.

Another test is to open a command window and use the tracert command to see what you latency is to several sites (try domains know to you that load slowly).

tracert www.google.com
tracert www.microsoft.com
etc

Numbers should preferably be under 100ms between hops.

What email client are you using? If OE or Windows Live, what type of account, eg; hotmail, gmail, msn, etc.

 

Hi, my Speakeasy Speed test results were 2600/320. Happy with that. They don't seem real world but I like them.

Tracert's were interesting. Google had a max of 73, my webmail site (www.mail.lycos.com) had 2 at around 200 out of the first 13, then the rest timed out. With ebay.com, first 13 were under 35, the rest were timed out.

Regarding the configuration with my sister-in-law who lives downstairs... we use the same phone/account for our DSL source, Earthlink (Covad). We use a DSL hard-wired network to distribute the 10/100 signal. No other network sharing, etc. We both use IE6, OE6, no Windows Live.

Could it be the router or the modem?. I am now using the WRT54G router since one one of the kids has a laptop (wireless). But I do have another little 4-port Linksys switch that I could try to see if that fixes it. Maybe I'll try that tomorrow if you think that that it is a possibility. The problem started about the same time for both of us. The modem is a 2-Wire that has always been pretty stable.

Thanks again, Lar

 

Run tracert again and if the results are the same (or comparable), check the server address(es) where the lag begins, then where it times out, and compare them to see if it's the same server(s) for each tracert.

You should also try loading a site (one known to load slow) through a proxy server too, to see if there's any difference.

 

I redid the tracert's. It is funny that those speeds are under 70 but sometimes it is 5-15 seconds before each line connects and is complete. Other times it is fast and does a whole sequence in 30 seconds.

The www.mail.lycos.com stopped at the 11th test at 209.165.108.162 which apparently is unreachable. It is described as a peerring2-barefruit.ca-paltoalto1.ne.earthlink.net. That happened on two different tracerts including one for 209.165.108.162 itself. The trace terminated at that point both times.

What does that mean?

 

It means the server at that address is dropping the ball. I'm surprised you got any results at all using www in that command. It's not a valid address that way. Try using just tracert mail.lycos.com

Is there any difference in load time if you go to http://mail.lycos.com via a normal web page vs through the proxy server link above?

 

tracert mail.lycos.com completed the cycle of 13 with the last 5 being around 100ms. None of the traces ran through earthlink addresses. I ran www.mail.lycos.com again just to see what happened and it ran through numerous earthlink addresses and ran into a wall at the same paloalto site again. The remaining traces were all timed out. I did notice that the IP addresses of the two mail.lycos.com addresses were different.

Regarding the proxy server link, the load up times seem similar.

Is it normal for the tracert process to stop for up to 15 seconds between traces?

Is it significant that if I trace google.com, it takes 9 traces, but if I trace www.google.com, it takes 14 traces... consistently?

 

I replaced my WRT54G with a Linksys 4-port switch without apparent benefit. Next, I will try to replace the modem and see what happens. Lar

 

Suggest you also check with neighbors on the same ISP to see if they're experiencing anything similar.

 

Don't know about the neighbors but my office is about a mile away and we are having similar issues there, too. But then again, we have always had line quality issues there. We have already been downgraded to 9xx/124 there. If we get worse or complain too much, Covad will kill the service!

At home, I took a backup modem that Earthlink had sent me years ago (a Broadmax) and tried it out and it would not even sync up. Does that indicate the my current 2-Wire modem is a very good sync'er and that my signal quality is such that a lesser modem becomes apparently so? If so, the down/up rate reduction my prove to be a benefit to me, as well.?

Or, or course, the Broadmax is a piece'o'* and/or is broken, and its inability to sync means nothing.

Any way to reliably test my line for quality from the comfort of my own home? I ran the DSL Reports Line Quality Test and everything passed! ???

 

That's not service Do they not have any competition there, that promotes good customer service? I've honestly never had to deal with a company that wouldn't properly investigate possible line issues. If you can't call and get them to happily come out and do a line quality test, I would suggest seeking help where there might be folks more knowledgeable in that area (or look into altenative providers). DSL Reports might be a good place to start. Folks over there are all about connection stuff.

 

Correct me if I am wrong but I am under the impression that in a given area there a lots of ISP's but DSL is assigned geographically and each area has just one company, like Covad in mine.

With Earthlink, getting thru tech support to a 1st tier tech that will contact Covad is like having to fly to New Dehli yourself (no I mean with my own arms)! It is disgusting. But I don't think that changing ISP's will actually change anything. Is this erroneous thinking? The phone company is only concerned about voice or fax service.

 

Modems have to be activated by the ISP. They are recognized and allowed throughput by their MAC address.

My understanding of DSL service is that you can get DSL service if within approx. 2 mi. of a substation. It's likely that your home and work are getting service from the same location.

 

Well, I went on vacation and upon my return, did the following... I got Earthlink (EL) to send me a new modem, expected shortly. I also found an article that discusses alternate DNS servers at EL. I found that other EL users in my area were have the same problems as I. (So, Dave, changing ISP's may have helped after all!)

Change your DNS settings in Network Connections to:

207.69.188.171 (west coast)

207.69.188.172 (east coast)

(If you're west of the Mississippi, use the west coast DNS server as your primary and the east coast as secondary. And vice-versa for those of you in the eastern U.S.)

These new settings have made a huge improvement in connectivity so far!!!

This articles source is this: Earthlink KB Article on Opt Out Servers

I hope that others find this helpful.

Dave, thanks a ton for all of your help. I will get back if there are further developments.

Lar

 

That's great news Larry! Thanks for posting back with an update, and the added information.