Help with HJT Log(Resolved)

[jholland1964]

Did you try turning off zone alarm also to see if connection could be made?

[jholland1964]

Try this;
Download and run WinSock XP Fix 1.2
See if this will correct things. Be sure it makes a registry back up.

[gln]

by the way, in response to your earlier post, I had turned off ZoneAlarm and it had made no difference.

When running winsockfix, while it was doing the registry backup, it displayed a number of errors "saving the file". I kept clicking "continue". It made the backup ( I guess) and went on to do the "fix". after a required reboot, things seem better. I was able to load several web sites. I loaded www.amazon.com (but without the graphics) without getting the "no server" error message. still no microsoft.com or weather.com.

I ran three different speed tests (while connected through DSL) and they were all clustering around 3.1 mbps for download and 420 kbps for upload.

do you think we should delete some of those programs that run at start-up to see if that would help?

[jholland1964]

I have the list of unnecessary start ups but first I want you to check what java version you are using. Go into Control Panel, Click on Java. When the control panel opens click on the About button. Tell me what version you are running.
For the heck of it, disable the Zone Alarm and run the dsl speed tests.

[gln]

Java is Standard Edition 6 version 1.6.0 (build 1.6.0_02-b06).

the average speed up and down was about the same with zonealarm.

[jholland1964]

I know this is a pain in the....but give me one more new HJT scan. Let me see for sure what can be removed from start, and see if the winsockfix made any changes. Then I will give you some speed up tips and items to remove from start up. Hopefully we can get this wrapped up tonight to your satisfaction.
Judy

[gln]

no problem at all. Its the least I could do. here is the highjackthis log. I was again unable to load the attachment. It was telling me that it was an invalid highjackthis log.

here is the log, cut and pasted.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:11:39 AM, on 8/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WFXSVC.EXE
C:\Program Files\Symantec\WinFax\WFXMOD32.EXE
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\DISC\DISCover.exe
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\WINDOWS\system32\wfxsnt40.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\DISC\DiscUpdMgr.exe
C:\Program Files\DISC\DiscStreamHub.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Startup Inspector for Windows\Startup Monitor\StartMonPrj.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HJT\hjtscan.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\webhelper.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe
O4 - HKLM\..\Run: [DiscUpdateManager] C:\Program Files\DISC\DiscUpdMgr.exe
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [HelpCenter4.1] C:\Program Files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe /P HelpCenter4.1
O4 - HKCU\..\Run: [StartupMonitor] C:\Program Files\Startup Inspector for Windows\Startup Monitor\StartMonPrj.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://help.bellsouth.net/sdccommon/...ad/tgctlcm.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europ...vex/hcImpl.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\hpbpro.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\hpboid.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\system32\WFXSVC.EXE

--
End of file - 11115 bytes

[jholland1964]

Ok, here we go....
The log looks pretty good.
First of all, I would Uninstall the Startup-Mechanic Startup monitor. Now supposedly this program is supposed to offer boot protection of your PC from harmful trojans, adult-dialers, and other scumware. Well it obviously did not work. Uninstall it.

Your System Restore can now be reset with a new, clean restore point.

Now for the unnecessary Start up programs;

The program I always recommend using (and do so myself) is Mike Lin's Startup Control Panel to turn off these unnecessary items. It is FREE, very easy to use. Just download and install it and you then will find it in your Control Panel.

Now to begin here is the list of installed programs showing that are auto-started that you CAN stop from auto-start using Mike Lin's program, NONE of these are not needed to run the computer, they use extra resources AND they also can slow your start up time and they all can easily be run MANUALLY when you need them;

ehTray>>>Enables the user to access Windows Messenger from within Windows Media Center Edition
RTHDCPL>>>Realtek HD Audio Sound Effect Manager
HPHUPD08>>>Related to Photosmart_Essential_Software from Hewlett-Packard
DISCover>>>on demand video games
DiscUpdateManager>>>related to DISCover
HPHUPD06>>>Belongs to the HP Photosmart application and is responsible for keeping this software upto date. This program is not essential to the running of the system
HPHmon06>>>Related to the Hewlett Packard software HP Photosmart printer, it provides easy access to flash card reading functions. This program is not essential to the running of the system. Your choice.
iTunes
iPod
RoboForm>>>Roboform - password manager and web form filler. Will work without this startup entry, as the "active" component is an integrated Internet Explorer browser plugin
Adobe Gamma Loader>>>Adjusts monitor colours across all programs, including Photoshop. It is needed by some graphics professionals who want their monitor calibrated. Most home users will not need it. In my case I can verify this as Photoshop loads fine
Adobe Reader Speed Launch>>>supposedly speeds the loading of the Adobe Reader, makes very little difference in the speed of the load of the program, turn it off.

Because Windows XP has to be all things to all people it has many services running that take up system resources that you will never need. Here also is a list of items (taken from ~TL's link How to configure Windows Services in XP) which you can either disable or set to manual using the Services section of Administrative tools. I have listed the entries and the recommended setting in order to speed up the computer;

Go to Start, Control Panel, Adminstrative Tools, Services;
The following entries can usually be disabled or set to manual, not all entries will be found on every machine, if you don't find it in yours don't worry about it, just double click on each of the listed and the configuration box will open for you to change the settings;
Alerter>>>disabled
Application Layer Gateway Service>>>manual
Automatic Updates>>>disable. Be sure to do these manually however.
Background Intelligent Transfer Service>>>Manual
Clipbook>>>disable
COM+ Event System>>>disable
COM+ System Application>>>disable
Computer Browser>>>manual
Distributed Link Tracking Client>>>disable
Distributed Transaction Coordinator>>>disable
Error Reporting Service>>>disable
Fast User Switching Compatibility>>>if you are the only user of thecomputer then disable
Help and Support>>>disable...this will change itself to automatic every time you use it so be sure to go back and reset to disable if you do use this.
Human Interface Device Access>>>manual
Indexing Service>>>a HUGE resource hog...disable
IPSEC Services>>>disable
Logical Disk Manager>>>if you do not plan to add additional hard drives you can disable this one.
Logical Disk Manager Administrative Service>>>same as above
Messenger>>>this is NOT MSN Messenger it is Windows Messenger>>>This service was originally made for administrators to send you messages over the network. This service is now being exploited by spammers to send you popup messages from over the Internet! Disable it
MS Software Shadow Copy Provider>>>manual
Net Login>>>manual
NetMeeting Remote Desktop Sharing>>>disable
Network DDE>>>disable
Network DDE DSDM>>>disable
Network Location Awareness (NLA)>>>manual
NT LM Security Support Provider>>>disable
Performance Logs and Alerts>>>disable
Portable Media Serial Number>>>disable...Retrieves serial numbers from portable music players connected to your computer. Disable it unless something of yours ceases to function properly afterwards this a privacy risk, as it will be contacting a server on the Internet and telling them what music you listen to.
QoS RSVP>>>disable...can cut your bandwidth speed down 20%
Remote Desktop Help Session Manager>>>disable
Remote Procedure Call (RPC) Locator>>>disable
Remote Registry Service>>>This allows remote users access to your registry!>>>disable
Routing and Remote Access>>>disable
Secondary Logon>>>disable
Security Accounts Manager>>>a security risk and should be>>>disable
SSDP Discovery Service>>>even Microsoft says this is a security risk>>>disable
System Event Notification>>>disable
TCP/IP NetBIOS Helper Service>>>disable
Telnet>>>big security risk as it can allow users access to your system remotely>>>disable
Terminal Services>>>disable
Uninterruptible Power Supply>>>manual
Universal Plug and Play Device Host>>>disable
Volume Shadow Copy>>>disable
WebClient>>>disable
WMI Performance Adapter>>>manual

Once you have completed all the above, reboot the computer. See if it is running any better...hopefully it does.
Judy

[jholland1964]

One more thing, when you have saved your HJT logs have you saved them with the file extension .txt? If you have saved them with another file extension like .log or .text then this is not a valid file extension and therefore they cannot be uploaded and you are given the message that it is invalid. When you save these logs be sure to save them as a text file, the extension is .txt
I believe this is why you have been unable to upload the last two logs as attachments.
Judy

[gln]

followed above instructions. I think I have also been having DSL line or modem issues. Am having a tech from bellsouth check this today. have been able today to connect to all web sites including microsoft.com and amazon.com and weather.com. Incredible!! however, it seems the connection drops periodically.

Yes, I was trying to load the highjackthis log as a .log file.

When connected, the computer is faster - thanks to you! when the DLS issues get resolved, I will give you a final report.

what are your next recommendations? System Restore flush?

and I would be really interested in your maintenance recommendations.

thanks for holding my hand through this.