[superdan54]

My modem will sporadically freeze the computer when I connect to the internet. I can run programs already open, but I cannot open any new programs and it freezes my browser. I originally thought this problem was due to malware, but I'm now wondering if its something else. I am able to restore normality by disconnecting or by terminating the largest SVCHOST.exe if I happen to have task manager open.

Any ideas? Should I post a HiJackThis log? My modem drivers are up to date as far as I know.

[Advertisements]

Driver problem usually, even more so if the system was using those drivers when it hung first time round.

Can usually sort this out by going into Device Manager, deleting the modem and then do a "Scan for hardware changes" so it finds the modem again and reinstalls dthe drivers.

[Neil Jones]

Driver problem usually, even more so if the system was using those drivers when it hung first time round.

Can usually sort this out by going into Device Manager, deleting the modem and then do a "Scan for hardware changes" so it finds the modem again and reinstalls dthe drivers.

[superdan54]

Do you think the drivers are corrupt, meaning I should download new ones from the manufacturer?

[Jack123]

01 – SuperDan54 –[Modem Freeze Browser Problem]
10 Feb 2006

Have you cleaned your Internet Temporary Files lately – Do this by –

(1) – Click – [Start Button]
(2) – Highlight – [Settings]
(3) – Open – [Control Panel]
(4) – Open – [Internet Options]
(5) – Click – [General] Tab – (Top of Page)
(6) – Click – [Delete Cookies] – Then Click – [OK]
(7) – Click – [Delete Files] – Ckeck – [Delete Off Line Content] – Click – [OK]
(8) – Click – [Clear History] – Click – [YES]
(9) – Click – [OK] Tab – (At Bottom of Page) to Exit

Next – Open – [Task Manager] –

(1) – Right Click – Open space on – [Task Bar]
(2) – Open – [Task Manager]
(3) – Click – [Processes] Tab
(4) – Record Number of Process running – [Post Back]
(5) – Minimize
(6) – Observe CPU Performance –[Post Back]

Answer these questions –

(1) – What type of Modem – [Dial UP] – [DSL] – [Cable]
(2) – How many Anti Virus Programs are running
(3) – What Browser are you using
(4) – How old is PC – Is it – HP Pavilion ze 547 – 512 MB – 40G HDD
(5) – How much Free space on 40 GB Drive
(6) – Have you defragged lately
(7) I see that you have – [3] – Malware Topic Threads that you have abandoned – [WHY] – You appear to have a trend/tendency to cease replying + you have 4 posts pertaining to same issue –
(8) Have you downloaded [Everest] yet

Jack123

[superdan54]

Answer these questions –

(1) – What type of Modem – [Dial UP] – [DSL] – [Cable]

I have a Conexant 56K Aclink Modem - the problem child
--My wife had to use our laptop at work on a broadband connection for over a month,
and she never had any problems, that's why I think its related to the dial-up modem.

(2) – How many Anti Virus Programs are running
--1 -> AVG

(3) – What Browser are you using
-- Internet Explorer, however this problem also affects FireFox

(4) – How old is PC – Is it – HP Pavilion ze 547 – 512 MB – 40G HDD
-- 2 years as of this March; yes it is the ze4547

ze4547 Product Specifications

(5) – How much Free space on 40 GB Drive
-- approx 10GB free

(6) – Have you defragged lately
-- no, but I will tonight

(7) I see that you have – [3] – Malware Topic Threads that you have abandoned – [WHY] – You appear to have a trend/tendency to cease replying + you have 4 posts pertaining to same issue –
-- I apologize for this, usually I am able to figure things out without bothering people too much, but this problem has stumped me. (The 3 abandoned topics were all the same problem I'm having) I felt like I probably worded it wrong, and since the responses were somewhat slow and not exactly what I was looking for, I felt I should probably start over. I do apologize for wasting your resources.

(8) Have you downloaded [Everest] yet
-- Yes I downloaded Everest when the first person suggested me too. However, I'm not sure how to use Everest to help me in this situation. Does it do Modem diagnostics?


Thank you for your patience and help!

p.s. I have also ran Task Manager while my Modem is connecting. The problem only occurs sporadically, but when it does, there are no processes I see that use an alarming # of Memory. It was really a trial & error process for me to find the SVCHOST offender in the first place.

However, I have noticed that the problem **USUALLY** occurs if I have already connected to the internet (i.e. It works the first time, but I have to restart for it to work properly again)

Edited by superdan54, 10 February 2006 - 04:31 PM.

[Jack123]

02 – SuperDan54 –[Modem Freeze Browser Problem]
10 Feb 2006

Thanks for the HP Specs -

Ok – You have a Dial up Modem – [Conexant 56K Aclink Modem] –

Do you think the drivers are corrupt, meaning I should download new ones from the manufacturer?

Not necessarily corrupt – just not up to date – You can – Update – Using [Device Manager] –That would be a good start – [To update Modem Driver]
________________________________________________________________________

Did you clean out Internet Files -

(3) – What Browser are you using
-- Internet Explorer, however this problem also affects FireFox

To clean this out – Fire Fox – Which is a different process than what I gave in previous Post -

(1) – Open Browser
(2) – Click – [Tools]
(3) – Click – [Options]
(4) – Clear – [Cookies] – Clear [History] – Clear – [Saved Info] – Clear – [Cache] – Clear – [History Manager]

Over a period of time – these files can accumulate/occupy a significant amount of space
______________________________________________________________________

p.s. I have also ran Task Manager while my Modem is connecting. The problem only occurs sporadically, but when it does, there are no processes I see that use an alarming # of Memory. It was really a trial & error process for me to find the SVCHOST offender in the first place.

Here is a link for SVCHOST - http://support.micro...om/?kbid=314056

And here is the link for the Home Page of this Article - http://support.micro...ect/?target=hub
________________________________________________________________________

(8) Have you downloaded [Everest] yet
-- Yes I downloaded Everest when the first person suggested me too. However, I'm not sure how to use Everest to help me in this situation. Does it do Modem diagnostics?

[Everest] – is a good – PC Analyzer Application – It does not actually do diagnostics – but Analyzes – It gives all PC Information – Plus some system suggestions – such as updates - & websites to visit – It is a Supersized [Device Manager/System Information] – [Everest] will describe your entire PC – For you to Analyze – It is a Good tool to keep in your – [Tool Box] -

I may ask you to attach a Report later – Right now I am just giving some general tasks & ideas -
___________________________________________________________________________

--My wife had to use our laptop at work on a broadband connection for over a month,
and she never had any problems, that's why I think its related to the dial-up modem.

This is my analysis of this statement –

You may need to disable this application – If it is still installed – You probably had an External DSL Modem – but may still have the application active –

Every time you connect to the Internet – This application is probably trying to run its updates & hanging up CPU –[Freezing] – trying to connect – It doesn’t care how the PC gets to the Internet – It does not necessarily have to be that application – but all applications that were active when connected to the Internet – Such as the [Live Updates] for – Anti Virus – MS Office – Windows - - This is another reason to clean out your – Browsers – Internet Clutter is another name for – [Spam] -

You may have to reconfigure your – [Internet Connections] – or cleanup/remove some old/unused items – Everything is done automatically for you – but it does not cover all circumstances -
Again here is MS Windows main link – search down thru for Dial Up - http://support.micro...ect/?target=hub This is a another good tool for your –[Tool Box]
____________________________________________________________________________

However, I have noticed that the problem **USUALLY** occurs if I have already connected to the internet (i.e. It works the first time, but I have to restart for it to work properly again)

I have to do some research on this – It is a – [Clue] – just needs a good/proper interpretation – Sounds as if the – [Dialup Setup] – needs updated – Are you using old Dialup configuration – or did you reinstall configuration –

Just might be that the Broadband & Dialup have some common denominator that is not being satisfied -
________________________________________________________________________

I apologize for this, usually I am able to figure things out without bothering people too much, but this problem has stumped me. (The 3 abandoned topics were all the same problem I'm having) I felt like I probably worded it wrong, and since the responses were somewhat slow and not exactly what I was looking for, I felt I should probably start over. I do apologize for wasting your resources.

This is a – [Good Trait] & This is what I thought you had done – I know it is very difficult to word your problem – If it was easy – You would not have a problem –

My hardest task – when helping – Is figuring out what the problem is – I have to establish the – [Real Problem] 1st – The way I work is –

(1) – Analyze Post thoroughly
(2) – List all the – [Known Data]
(3) – List my – [Questions/Unknowns]
(4) – Review Poster’s Topics – Analyze & try to connect all this info
(5) – Decide if I can add or suggest some helpful/useful information or tools
(6) – Either Pass – Subscribe & Wait – or Jump in & Answer –

I consider myself as being very thorough/complete and try to find – [Root Cause] of problem – but many times I can only offer – [An Acceptable Work Around Plan] – I like to give suggestions & have the Poster [Learn] to fix their Problem – Then I review and see what I have learned – and add to my – [Tool Box] –

(7) Record Number of Process running – [Post Back]

You did not answer this question/request – Just another piece of the equation ??

Jack123

Edited by Jack123, 11 February 2006 - 12:12 PM.

[superdan54]

WOW

That was the most thorough response to a problem I have ever gotten! thanks!

I haven't tried all of the options, but I thought I would update what I have done. To answer your final question, I usually average around 50 processes running at any given time (49 right now). However, when the problem occurs, It doesn't seem like anything is maxing out the CPU processing.

You may need to disable this application – If it is still installed – You probably had an External DSL Modem – but may still have the application active –

My wife had a T1 connection at work, so it probably wasn't that. However, we used to have SBC Yahoo DSL, which did have an external modem. We had to cancel it b/c we moved to a house that was out of the DSL range. I uninstalled all the SBC yahoo software, but do you think something could still be in the registry?

Not necessarily corrupt – just not up to date – You can – Update – Using [Device Manager] –That would be a good start – [To update Modem Driver]

The Device Manager could not find any updated drivers. (I did connect to Windows Update)

Did you clean out Internet Files -

Yes - but there was only 12 MB of cached files.

This may be something of interest as well. We use the Free Netzero service to connect at home, since we don't use the internet all that much at home, just to update Virus scan & download bank statements and a few other misc things. I have reinstalled Netzero, but it didn't help. But to test whether it was Netzero, I used my Grandma's internet account (she uses a local internet provider) for a couple of days, and I experienced the same problems.

Ok well hope this at least eliminates some possibilites. Thanks again!

[superdan54]

Since my last post, I checked out the Microsoft article on SVCHOST.EXE and I think we may be onto something there. Unfortunately, I have XP Home, which does not come with the TASKLIST function that shows what each svchost is running.

However I did check out the registry entries for SVCHOST. The key labeled "netsvcs" has the longest string, so I'm guessing it's the one I'm having issues with. I've listed below all the services tied into this particular SVCHOST key.

6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
ERSvc
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Messenger
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
TermService
wuauserv
BITS
ShellHWDetection
helpsvc
WmdmPmSN
xmlprov
wscsvc


Do any of those look like possible offenders? Or is it just running too much at once, and thus bogging everything else down? If so, how do I get rid of some of them.

Thanks again.

p.s. I forgot to mention that I did defrag my laptop, but only two files were fragmented and it didn't look like it really needed it.

Edited by superdan54, 12 February 2006 - 07:36 PM.

[Jack123]

03 – SuperDan54 –[Modem Freeze Browser Problem]
12th Feb 2006

This may be something of interest as well. We use the Free Netzero service to connect at home, since we don't use the internet all that much at home, just to update Virus scan & download bank statements and a few other misc things. I have reinstalled Netzero, but it didn't help. But to test whether it was Netzero, I used my Grandma's internet account (she uses a local internet provider) for a couple of days, and I experienced the same problems.

Lets look at Internet Connections –

(1) – Click on – [Start Button]
(2) – Highlight – [Settings]
(3) – Open – [Control Panel]
(4) – Open – [Internet Options]
(5) – Click – [Connections] Tab
(6) – Anything of interest have permission to internet – List what you see
____________________________________________________________________________

Do any of those look like possible offenders? Or is it just running too much at once, and thus bogging everything else down? If so, how do I get rid of some of them

Lets check Startup –

(1) – Click on – [Start Button]
(2) – Click on – [Run]
(3) – Type in – msconfig
(4) – Click – [OK]
Make a List of items in [Left Column]
__________________________________________________________________________

Well – this is getting out of my area of expertise – I will see if I can find a Staff Member that has experience with this data that you have compiled -

Post the 2 Items – [Internet Connections] & [Startup] so that all data is shown -

Jack123

[superdan54]

Here are all the Processes that run on Startup (Taken from a HiJackThis Log)

O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\System32\taskswitch.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe

I have 5 connections listed under my Dial-Up Connections. Two I no longer use, one is the NetZero, one is my Grandma's Local ISP account, and one is titled "Virtual Private Connection". I removed the two I don't use anymore, but I don't think its the root of the problem. Any more info on the SVCHOST list I sent?

Thanks again for the help.

[Samm]

Hi superdan54

Jack123 has asked me to have a look at your problem. Before I advised anything though, I'm going to ask you to do 2 things :

1) Download & run ProcessExplorer (link below). This is a freeware utility from Sysinternals that does a similar job to Tasklist. When you open the link, scroll right to the bottom of the page for the download section :
http://www.sysintern...ssExplorer.html

2) HJT logs are not meant to be posted outside of the malware forum. However I noticed that you have never actually posted your complete HJT log, even when you has threads running in the malware forum. Can you please run HJT & PM me the log (don't post).

Thanks
Samm

[superdan54]

Wow! What a neat little tool! I'll run it tonight and post my findings.

thanks!

[superdan54]

Ok I PM'd you my HiJack This log.

And now for the good stuff....

I think I may have found the source of the problem using the Process Manager tool. The particular SVCHOST file that is giving me havoc apparently runs the Windows Automatic Update tool (WUAUCLT.EXE) & the Windows Security Center Notification App (WSCNTFY.EXE). I noticed that it (WUAUCLT.EXE) was running when my modem froze momentarily when I connected, and then was gone. However, they are both running right now, so I guess I'm not 100% sure. Could this be the culprit?

[Samm]

I received the HJT log, thanks. I'll come back to that at the end of this post.

Re. wuauclt.exe, one thing I did notice from your HJT log, is that wuauclt.exe is not listed in there, which it should be unless it has been disabled. Just to double check that this is the legitimate copy of wuauclt.exe, can you run a search on the C drive for the file (make sure you have 'search sub-folders' & search in system/hidden files & folders options selected.
With each instance of wuauclt.exe that is found, make sure it resides in either the SYSTEM32 folder, i386 folder or DLLCACHE folder. Also check the file size, depending on how up to date your SP2 is, the file size should be either 124,184 or 113,944.

If you wish to disable Windows Automatic Updates from starting up, go to control panel->administrative tools->services. Change the startup type for automatic updates to Disabled.

You should be able to do the same thing for Windows Security Centre Noification.
Remember that we are just disabling these for diagnostic purposes. If you leave them permanently disabled, then you should regularly check for updates manually instead.

Let me know if disabling these two things make any difference to your problem.

Re. HJT log :
From what I can tell, you don't have any nasty malware problems. You do however appear to have a lot of stuff in there which will potentially slow the system down & may even be causing a problem. Namely, Google toolbar/search assistant, Yahoo Messenger etc, MSN Messenger, NetZero toolbars & search assistants and so on. You may want to think about getting rid of some of these!

I also noticed that you appear to have Netscape installed. Is that correct? If so, do you use it & do you have similar problems with it?


Can you also run Process Manager utility again but this time, create a report. To do this, make sure that none of the processes are highlighed (selected), then go to File->Save as. This will create a text file snap shot of the process list which you can then post.

[superdan54]

Hi,

I apologize for my lack of response lately. The past week and a half have been extremely hectic and I didn't have any time to look into the problem.

anyway, I searched for the wuauclt.exe file and came up w/ 4 results (1 was in the Prefetch folder...can I delete it?).

The other three were as follows: [path - size - date modified]

1. C:\windows\system32 - 122KB - 5/26/2005
2. c:\Windows\ServicePackFiles\i386 - 109KB - 8/4/2004
3. C:\windows\SoftwareDistribution\Download\[some random key] - 109KB - 8/4/2004

-so nothing really looks fishy there.

When I connected this time, the modem froze for like 5 minutes, and then everything opened. However, I noticed that Automatic Updates was still trying to download something. So I went ahead and let it download the whole thing this time, and hopefully from now on it won't try and automatically download.

Did you want me to PM you the Process Explorer, or just wait a week and see if the problem has been resolved? Thanks again for your help.