[mikestang63]

I have two different problems that I hope you can assist me with. I am guessing they are related issues. I did not know which Forum to post, so I chose the XP as that is my OS.

Here is information on my laptop.

Dell Inspiron 1150
Windows XP Pro V2002
Service Pack 3
Intel P4
2.80 GHZ
1.59GHZ
80GB hard drive 47GB free space
total physical memory 512MB
available 118 MB
Virtual Memory 2GB
Available 1.96GB
Wireless adapter- Dell 1350 WLAN mini-PCI Card
LAN- Broadcom 440x 10/100 Integrated Controller
Running IE7 and Mozilla 3.0.16



I currently have a PC and a laptop. My ISP is DSL with Bellsouth. It is via a Westell DSL modem, then connected with an ethernet cable to a Hawking HWR54G wireless router for the laptop. Hammerman helped me with nasty virus a few weeks back that was resolved. I currently have for protection

Avast
Online Armor
TFC
ATF
CC Cleaner
SuperantiSpyware
Spybot
Sypblaster
Malwarebytes
ADblocker Plus

For the last few weeks, if I move more than 10 feet away with the laptop or stay on the laptop for more than an hour, I have had to unplug and replug the power out of the router, as it seems to internet. It still shows connected but it will just time out. It is very annoying.

Also whenever I first boot up the laptop, and when I establish an ISP connection and try open a browser for the first time- Mozilla, IE, the SVCHOST.exe spikes to almost 100% for a few minutes. Once connected this goes away, but then I have to unplug the wireless router to re-establish the ISP again.

I have installed Process Explorer and this is the printout for the svchost that is maxing out #1160. This is the command line for that svchost C:\WINDOWS\system32\svchost.exe -k NetworkService. This service host registered for this is the DNS cache. The path is C:\WINDOWS\system32\dnsrslvr.dll.


PProcess PID CPU Description Company Name Command Line
System Idle Process 0 94
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4
smss.exe 488 Windows NT Session Manager Microsoft Corporation \SystemRoot\System32\smss.exe
csrss.exe 528 1 Client Server Runtime Process Microsoft Corporation C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
winlogon.exe 552 Windows NT Logon Application Microsoft Corporation winlogon.exe
services.exe 596 1 Services and Controller app Microsoft Corporation C:\WINDOWS\system32\services.exe
svchost.exe 768 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe 812 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost -k rpcss
svchost.exe 904 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\System32\svchost.exe -k netsvcs
wuauclt.exe 428 Windows Update Microsoft Corporation "C:\WINDOWS\system32\wuauclt.exe"
svchost.exe 948 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe 1160 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost.exe -k NetworkService
svchost.exe 1220 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost.exe -k LocalService
oacat.exe 1368 Online Armor Component Tall Emu "C:\Program Files\Tall Emu\Online Armor\OAcat.exe"
aswUpdSv.exe 1600 avast! Antivirus updating service ALWIL Software "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
ashServ.exe 1656 avast! antivirus service ALWIL Software "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
LEXBCES.EXE 304 LexBce Service Lexmark International, Inc. C:\WINDOWS\system32\LEXBCES.EXE
spoolsv.exe 364 Spooler SubSystem App Microsoft Corporation C:\WINDOWS\system32\spoolsv.exe
svchost.exe 1456 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost.exe -k LocalService
fsproflt.exe 1672 FSPro Labs Filter Service FSPro Labs C:\WINDOWS\system32\fsproflt.exe
hnm_svc.exe 1772 Advanced Networking Service SingleClick Systems "C:\Program Files\Dell Network Assistant\hnm_svc.exe"
jqs.exe 472 Java™ Quick Starter Service Sun Microsystems, Inc. "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"
svchost.exe 860 Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost.exe -k imgsvc
WLTRYSVC.EXE 1204 C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe
BCMWLTRY.EXE 1836 Dell Wireless WLAN Card Wireless Network Controller Dell Inc. C:\WINDOWS\System32\bcmwltry.exe
WPSScannerSvc.exe 1424 Wi-Fi Scanner Service Skyhook Wireless "C:\Program Files\Skyhook Wireless\Wi-Fi Service\WPSScannerSvc.exe"
alg.exe 2736 Application Layer Gateway Service Microsoft Corporation C:\WINDOWS\System32\alg.exe
ashMaiSv.exe 2564 avast! e-Mail Scanner Service ALWIL Software "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
ashWebSv.exe 236 avast! Web Scanner ALWIL Software "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
oasrv.exe 1808 Online Armor Component Tall Emu "C:\Program Files\Tall Emu\Online Armor\oasrv.exe"
lsass.exe 608 LSA Shell (Export Version) Microsoft Corporation C:\WINDOWS\system32\lsass.exe
explorer.exe 796 1 Windows Explorer Microsoft Corporation C:\WINDOWS\Explorer.EXE
BCMSMMSG.exe 3816 Modem Messaging Applet Broadcom Corporation "C:\WINDOWS\BCMSMMSG.exe"
hkcmd.exe 3384 hkcmd Module Intel Corporation "C:\WINDOWS\system32\hkcmd.exe"
WLTRAY.EXE 3880 Dell Wireless WLAN Card Wireless Network Tray Applet Dell Inc. "C:\WINDOWS\system32\WLTRAY.exe"
mylbx.exe 2496 My Lockbox FSPro Labs "C:\Program Files\My Lockbox\mylbx.exe" /a
ashDisp.exe 3784 avast! service GUI component ALWIL Software "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
LEXPPS.EXE 2796 LEXPPS.EXE Lexmark International, Inc. "C:\WINDOWS\system32\lexpps.exe"
vidalia.exe 3736 Vidalia vidalia-project.net "C:\Program Files\Vidalia\vidalia.exe"
tor.exe 1288 "C:\Program Files\Tor\tor.exe" -f "C:\Documents and Settings\Administrator\Application Data\Vidalia\torrc" ControlPort 9051
ctfmon.exe 412 CTF Loader Microsoft Corporation "C:\WINDOWS\system32\ctfmon.exe"
privoxy.exe 2460 Privoxy The Privoxy team - www.privoxy.org "C:\Program Files\Privoxy\privoxy.exe"
firefox.exe 3216 Firefox Mozilla Corporation "C:\Program Files\Mozilla Firefox\firefox.exe"
msimn.exe 2180 Outlook Express Microsoft Corporation "C:\Program Files\Outlook Express\msimn.exe"
procexp.exe 868 3 Sysinternals Process Explorer Sysinternals - www.sysinternals.com "C:\Documents and Settings\Administrator\Desktop\procexp.exe"
oaui.exe 2472 Online Armor Component Tall Emu "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
oahlp.exe 2272 Online Armor Component Tall Emu "C:\Program Files\Tall Emu\Online Armor\OAhlp.exe"

I read where Windows defender sometimes causes problems and deleted it. I also heard that Windows Automatic Updates sometimes cause svchost problems, but this one does not appear to be assigned to that?

I tried disabling the avast and online armor, but that does not seem to help. I ran devmgmt.msc and their are no yellow marks next to anything. I've read SP3 causes problems? sometimes... Maybe I should uninstall it and go back to SP2?


Thank you in advance for your help. Please let me know what I can do to help assist you further.

[Advertisements]

I apologize for posting but I wanted to add that Firefox is running EXTREMELY slow now as well. I disabled the DNS cache svc host and that seems to have helped somewhat. I have run malware, superantispy, TFC, ATF, and avast. All come up clean.

[mikestang63]

I apologize for posting but I wanted to add that Firefox is running EXTREMELY slow now as well. I disabled the DNS cache svc host and that seems to have helped somewhat. I have run malware, superantispy, TFC, ATF, and avast. All come up clean.

[Broni]

Your System Idle Process (CPU NOT used) is at 94%, which is perfectly normal.
You must have some other issues.

Are we talking here about internet slowness, or computer slowness?

[mikestang63]

Broni,

Thanks for getting back to me. Startup is slow as well as Internet browsers- both Mozilla and Firefox. When I first started up, the SVChose spiked to 100% and remained there for mintues as well as when first opening up a browser. I have since disabled the DNS cache host and it seems to have made that issue better?

The problem with the web browser remains. It is peculiar that is is most prevalent with Yahoo, often not allowing me to perform functions in Yahoo (worse in Firefox)

Here's my OTL log


Thanks and let me know what else I can provide to help you.

Edited by Rorschach112, 10 January 2010 - 05:39 PM.
removed log

[Broni]

I'm not allowed to analyze your OTL log.
If you think, you may be infected....

I suggest that you start a new topic in the Malware Removal and Spyware Removal area.

Before you start a new topic click on this link --> Malware and Spyware Cleaning Guide, Please read before starting a new topic. This will give you a few preparations to make, as well as instruction for posting your OTListIt2 log.

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

[mikestang63]

Broni,

I do not think I am infected. I was wondering if you had any suggestions to resolve this issue.

Thank you

[Broni]

Download Autoruns for Windows: http://technet.micro...s/bb963902.aspx
No installation required.
Simply unzip Autoruns.zip file, and double click on autoruns.exe file to run the program.
Go File>Save, and save AutoRuns.txt file to know location.
Attach the file to your next reply.

[mikestang63]

 AutoRuns.txt   108.3KB   156 downloadsBroni,

Thank you. Please see the attached file per your instructions.

[Broni]

I don't see too many startups.
You surely could use another 512MB of RAM. That would definitely speed things up.

I still want you to go to malware forum and make sure, your computer is clean.
If it is, we'll go from there.

[mikestang63]

Will do.

Thanks again!

[Broni]