Member Avatar for wilsona

When I start up my computer, ny internet connection functions for
anywhere from 5 minutes to half an hour. After that it stops working.
The connection is still present, but I can't load any web pages, get
email, or ping any hosts or IPs. I can use the internet just fine
when I load up Linux, so it's not a hardware issue. I've also
recently gone from dial up to a cable modem. I wouldn't consider
myself an expert, but I'm no slouch, either, and it doesn't seem to be
a hardware or configuration issue.
I've run all the scans for viruses, malware, spyware, and the like
suggested elsewhere in these forums. The scans found some issues, but
the problem didn't go away.

HijackThis Log follows. Thanks for any ideas.


Logfile of HijackThis v1.98.2

Scan saved at 8:46:39 PM, on 11/16/04

Platform: Windows 98 SE (Win9x 4.10.2222A)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\SYSTEM\NVSVC.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\TASKMON.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE

C:\WINDOWS\SYSTEM\STIMON.EXE

C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE

C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE

C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE

C:\WINDOWS\RUNDLL32.EXE

C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\HIJACKTHIS\HIJACKTHIS.EXE

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

O4 - HKLM\..\Run: [SystemTray] SysTray.Exe

O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe

O4 - HKLM\..\Run: [Fix-It AV] C:\PROGRA~1\ONTRACK\SYSTEM~1\MEMCHECK.EXE

O4 - HKLM\..\Run: [POINTER] point32.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP

O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE

O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE

O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [NVSvc] C:\WINDOWS\SYSTEM\nvsvc.exe -runservice

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html

O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html

O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html

O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html

O8 - Extra context menu item: Translate Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html

  • 3 Contributors
  • 6 Replies
  • 131 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by wilsona

Dani AI

Generated

— because the modem and the same hardware behave correctly under Linux but the Windows box loses all IP traffic after a while, this is almost certainly a Windows-layer problem (driver, protocol stack, or a userland app hooking the stack), not a modem or ISP fault. was right that the HijackThis output didn't show an obvious trojan, and correctly pointed out Win9x has poor logging — so the fix will be more investigative than reading an event log.

Try these focused checks in order (quick to more invasive):

  1. Boot Windows into Safe Mode with Networking and exercise the network for longer than the usual failure window. If it stays up, a startup service or third-party driver is the likely cause.
  2. Temporarily disable any third-party network filters/inspectors (AV realtime, spyware guards, packet-filter firewalls, system monitors) and any scheduled scans. Those often hook NDIS and can leak or block sockets over time.
  3. Give Windows a static IP (use the same gateway/DNS values that work from Linux) and test. If the problem disappears, it points at DHCP renewal or lease interaction with the modem.
  4. Reinstall or update the NIC driver, or try a different NIC. A buggy NDIS driver will behave properly for a short time then fail.
  5. Reset the TCP/IP/Winsock stack by removing and re-adding the TCP/IP component in Network settings (backup the registry first).

If those fail, capture packets around the failure with a sniffer on another machine (or on the Windows box if possible) and check the cable modem’s web/log page for DHCP or MAC events. Watch scheduled tasks and resource use at the moment it dies — many intermittent problems coincide with scans or updates. If nothing isolates it, a clean reinstall of Windows or using Linux as the router/primary will confirm whether the OS install itself is the issue.

Recommended Answers

All 6 Replies

Member Avatar for crunchie

Cannot see anything bad in that log. :(

Member Avatar for wilsona

That's what I thought, too! I just really don't know what it could be or where I could look that I haven't already. I checked the HijackThis startup log and didn't see anything there, either.

Member Avatar for crunchie

Have you tried using another browser, such as Firefox to see if the same thing happens? If not, maybe you should.

Member Avatar for wilsona

Yes, I have. It happens with IE, Firefox, and Opera. The connection stops working at all... can't get e-mail, can't so much as ping a known IP address.

Member Avatar for DMR

Well, since the problem occurs across browsers, but does not happen in Linux, I'd suggest that you check your Win systems logs. The only problem with that is the fact that Win 9.x doesn't do much logging; it's rather limited in its ability to leave clues. Grr... :(

Are you getting a dynamically-assigned IP via DHCP, or has your ISP given you a static IP config?

When the connection gets dropped, run winipcfg and see if it has anything illuminating to report.

Member Avatar for wilsona

What logs are there for Win 98 and where are they?
Dynamic IP via DHCP.
winipcfg doesn't tell me anything. The connection doesn't actually get dropped. The cable modem stays connected just fine, when I was dialing up, it stayed connected, too. Windows just stops transmitting data up or downstream.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.