I have a PIII with 512Mb of RAM, running Windows XP Pro with SP2 installed. Antivirus protection is from Avast! Home Edition. Firewall is Zone Alarm (not pro) with the Internet security zone set to "High".
Spyware protection is from Spybot Search and Destroy and Spyware Baster. Trojan protection is Trojan Hunter Guard.
All the above utilities have both engines and definitions up-to-date. Most are set to update automatically where this is an option. None reported problems before or subsequent to the problem I am about to describe (including manually initiated scans with all the above utilities).
The PC connects to the Internet via a NetComm NB1300 Plus 4 modem/router, driven via Ethernet. The Ethernet board is a Realtek RTL8139/810x Family Fast Ethernet NIC. It has the latest drivers from Realtek. Realtek Diagnostics indicate that register access, eeprom access, loopback and link all pass. However, when I try to run Advanced Diagnostics in Initiator mode it responds Responder not found and similarly in Responder mode it responds Initiator not found.
LAN Connection properties have TCP/IP enabled, with IP and DNS addresses assigned automatically. Client for Microsoft Networks is enabled, but QoS Packets and File and Printer sharing are not. IEEE 802.1x authentication is enabled via Smart Card or other Certificate. I assume all these were set by the modems install program, since I did not set them myself. The LAN Address is assigned by DHCP.
This set-up worked okay for the past three months or so. Then I began to notice that the PC would slow down immediately on starting. Task Manager revealed that an instance of svchost.exe was using 90 to 100% of CPU.
Investigation with Process Explorer (
www.sysinternals.com) showed that the problematic instance of svchost.exe was being used by the DNS service. If logged in as Administrator I am able to kill the process. This causes a disconnection from the net but this appears to re-establish itself and work normally. However, from time to time the problem will occur, resulting in a loss of function usually at a crucial time. It also means that non-administrator users, who cannot kill the process, face using a slow PC which cant go online and which eventually sounds and overheat alarm which cant be doing the CPU any good!
For the sake of clarity I have edited a netstats a log and append this below. I have removed the Foreign Address column, which read 0.0.0.0:0 for every TCP instance and *:* for every UDP instance; and removed the State column which read LISTENING for every TCP instance and was blank for every UDP instance.
Proto Local Address PID
TCP 0.0.0.0:80 1736
TCP 0.0.0.0:135 796
TCP 0.0.0.0:445 4
TCP 0.0.0.0:1027 1560
TCP 0.0.0.0:2522 1560
TCP 0.0.0.0:2901 1560
TCP 0.0.0.0:8103 1560
TCP 0.0.0.0:8500 1560
TCP 0.0.0.0:19997 1540
TCP 0.0.0.0:19998 1612
TCP 0.0.0.0:50300 1700
TCP 127.0.0.1:25 2504
TCP 127.0.0.1:110 2504
TCP 127.0.0.1:143 2504
TCP 127.0.0.1:1032 2748
TCP 211.27.201.49:139 4
UDP 0.0.0.0:445 4
UDP 0.0.0.0:500 548
UDP 0.0.0.0:4500 548
UDP 127.0.0.1:123 840
UDP 127.0.0.1:1446 784
UDP 127.0.0.1:1900 972
UDP 127.0.0.1:2233 3340
UDP 211.27.201.49:68 840
UDP 211.27.201.49:123 840
UDP 211.27.201.49:137 4
UDP 211.27.201.49:138 4
UDP 211.27.201.49:1900 972
HiJack this logfile for above
--------------------------
----------
----------
----------
----------
----------
----
Logfile of HijackThis v1.99.1
Scan saved at 8:35:07 PM, on 23/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.e
xe
C:\WINDOWS\system32\csrss.
exe
C:\WINDOWS\system32\winlog
on.exe
C:\WINDOWS\system32\servic
es.exe
C:\WINDOWS\system32\lsass.
exe
C:\WINDOWS\system32\svchos
t.exe
C:\WINDOWS\system32\svchos
t.exe
C:\WINDOWS\System32\svchos
t.exe
C:\WINDOWS\System32\svchos
t.exe
C:\WINDOWS\system32\spools
v.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast
4\ashDisp.
exe
C:\WINDOWS\system32\RUNDLL
32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.ex
e
C:\WINDOWS\system32\ctfmon
.exe
G:\Program Files\Tweak-XP Pro\AdBlocker.exe
G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\rundll
32.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.e
xe
C:\Program Files\Alwil Software\Avast4\ashServ.ex
e
G:\CFusionMX\runtime\bin\j
runsvc.exe
G:\CFusionMX\db\slserver52
\bin\swage
nt.exe
G:\CFusionMX\runtime\bin\j
run.exe
G:\CFusionMX\db\slserver52
\bin\swstr
tr.exe
G:\CFusionMX\db\slserver52
\bin\swsoc
.exe
C:\WINDOWS\system32\nvsvc3
2.exe
C:\WINDOWS\System32\oodag.
exe
C:\WINDOWS\System32\svchos
t.exe
C:\WINDOWS\SYSTEM\svchost.
exe
C:\WINDOWS\System32\wdfmgr
.exe
C:\WINDOWS\system32\ZoneLa
bs\vsmon.e
xe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.e
xe
C:\Program Files\Alwil Software\Avast4\ashWebSv.e
xe
C:\WINDOWS\System32\alg.ex
e
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuaucl
t.exe
G:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe
G:\Program Files\HiJack This\HijackThis.exe
R0 - HKCU\Software\Microsoft\In
ternet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Wi
ndows\Curr
entVersion
\Internet Settings,ProxyServer = proxy.iprimus.com.au:8080
R1 - HKCU\Software\Microsoft\Wi
ndows\Curr
entVersion
\Internet Settings,ProxyOverride = *.iprimus.com.au;*.primust
el.com.au;
*.primus.c
om.au;<loc
al>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-7
84B7D6BE0B
3} - G:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIE
Helper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
06D7942484
F} - G:\PROGRA~1\SPYBOT~1\SDHel
per.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
F10577473F
7} - c:\program files\google\googletoolbar
3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0
445EE16191
0} - G:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClien
t.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0
819E2EAAC9
3} - G:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClien
t.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
09027A5CD4
F} - c:\program files\google\googletoolbar
3.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCh
eck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast
4\ashDisp.
exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.
dll,NvStar
tup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTr
ay.dll,NvT
askbarInit
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.ex
e"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe
" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon
.exe
O4 - HKCU\..\Run: [BlockAds] "G:\Program Files\Tweak-XP Pro\AdBlocker.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad
obe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Mic
rosoft\Int
ernet Explorer\Restrictions present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar
3.dll/cmse
arch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar
3.dll/cmba
cklinks.ht
ml
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar
3.dll/cmca
che.html
O8 - Extra context menu item: Download using Download &Express - file://C:\Program Files\Download Express\Add_Url.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~1
\Office10\
EXCEL.EXE/
3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar
3.dll/cmsi
milar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar
3.dll/cmtr
ans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
0C04F79568
3} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
0C04F79568
3} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: DigiChat Applet -
http://albany.digi-net.com/DigiChat/DigiClasses/Client_IE_5_0_1_7.cabO16 - DPF: {2B323CD9-50E3-11D3-9466-0
0A0C970049
8} (Yahoo! Audio Conferencing) -
http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cabO16 - DPF: {2FC9A21E-2069-4E47-8235-3
6318989DB1
3} (PPSDKActiveXScanner.MainS
creen) -
http://ppupdates.ca.com/downloads/scanner/axscanner.cabO16 - DPF: {4C39376E-FA9D-4349-BACC-D
305C1750EF
3} (EPUImageControl Class) -
http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-12.cabO16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6
A52B394EC3
B} (WSDownloader Control) -
http://www.webshots.com/samplers/WSDownloader.ocxO16 - DPF: {7D1E9C49-BD6A-11D3-87A8-0
09027A35D7
3} (Yahoo! Audio UI1) -
http://chat.yahoo.com/cab/yacsui.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4
DFAD1796A8
D} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cabO16 - DPF: {9B03C5F1-F5AB-47EE-937D-A
8EDA626F87
6} (Anonymizer Anti-Spyware Scanner) -
http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cabO16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F
385591623A
F} (Solitaire Showdown Class) -
http://messenger.zone.msn.com/binary/SolitaireShowdown.cab30149.cabO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.e
xe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.ex
e
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.e
xe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.e
xe" /service (file missing)
O23 - Service: ColdFusion MX Application Server - Macromedia Inc. - G:\CFusionMX\runtime\bin\j
runsvc.exe
O23 - Service: ColdFusion MX ODBC Agent - Unknown owner - G:\CFusionMX\db\slserver52
\bin\swage
nt.exe
O23 - Service: ColdFusion MX ODBC Server - Unknown owner - G:\CFusionMX\db\slserver52
\bin\swstr
tr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService
.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc3
2.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\System32\oodag.
exe
O23 - Service: MS Software Generic Host Process for Win32 Services (svchost) - Unknown owner - C:\WINDOWS\SYSTEM\svchost.
exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLa
bs\vsmon.e
xe
That's it. If there's any other information you require, ask and I'll do my best to find it.
Thanks for helping!
