Slow modem, someone stealing bandwidth?

edcentric

Here is the log from my wife's machine.
KT7A, XP2000, 512 SDRAM, R8500
W2k, firefox 0.9
AVG, Adaware and S&D run always.
The modem seems real slow these days.
Comments please.

Logfile of HijackThis v1.98.2
Scan saved at 6:39:11 AM, on 8/17/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\MOTHER~1\MBM5.EXE
D:\SCANJET\PrecisionScanLT\hppwrsav.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
D:\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Scroll\Scroll.exe
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\PROGRA~1\MOTHER~1\DLL\display.dll
D:\Program Files\firefox\firefox.exe
D:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MBM 5] "C:\PROGRA~1\MOTHER~1\MBM5.EXE"
O4 - HKLM\..\Run: [hppwrsav] D:\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [EarthLink Installer] " /C
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Microsoft Office Shortcut Bar.Lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Scroll-In-Mouse Program.lnk = C:\Program Files\Scroll\Scroll.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7A19DCF4-66E5-4595-A42F-4C280B079E36}: NameServer = 207.69.188.187 207.69.188.186

edcentric

Dexter, see anything wrong?
Yes, my daughter uses AIM. She claims that she never dl's anything (sure).

GHoosdum

That is an exceptionally clean log, ed.

primesuspect

Well, this is the only one that looks weird to me:

O4 - HKLM\..\Run: [EarthLink Installer] " /C

Also, you could definitely get rid of these:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - Startup: Microsoft Office Shortcut Bar.Lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Scroll-In-Mouse Program.lnk = C:\Program Files\Scroll\Scroll.exe

Other than that, it doesn't look like anything malicious is in there.

GHoosdum

Not that those are malicious, just resource hogs...

Dexter

I agree, looks pretty clean except for the resource hogs Prime ID'd (Earthlink installer is probably your ISP's install program, and likely keeps your homepage set to their site. Toast it, it's not needed.)

Contact your ISP and ask them to do a diagnostic on your modem. Also, make sure your modem is not overheating (I moved mine from beside my computer, it seemed to work better after that, so try moving it away from heat generating eqpt.)

Since this is not SVT related, I will close the thread. PM one of us to open it if you discover something new. If you suspect hardware troubles, start a thread over in the networking forum and reference this one.

Dexter...