network problems with SP2

[Lynn Oliver]

After installing SP2 I've been experiencing two different problems:

1. From time to time a dialog box will appear asking to make a connection to
the internet (sometimes it wants to connect via dialup, other times it wants
to reconnect). I'm connected via DSL.

2.From time to time web pages will display briefly and then display the
screen indicating that a connection to the server is not available. When
this happens reaccessing the page usually just repeats the behavior. One
site that often acts this way is msnbc.com.

The two problems do not seem to occur at the same time.

Any ideas?

Lynn

[Malke]

Lynn Oliver wrote:

> After installing SP2 I've been experiencing two different problems:
>
> 1. From time to time a dialog box will appear asking to make a
> connection to the internet (sometimes it wants to connect via dialup,
> other times it wants
> to reconnect). I'm connected via DSL.
>
> 2.From time to time web pages will display briefly and then display
> the
> screen indicating that a connection to the server is not available.
> When
> this happens reaccessing the page usually just repeats the behavior.
> One site that often acts this way is msnbc.com.
>
> The two problems do not seem to occur at the same time.
>
> Any ideas?
>
> Lynn

Are you sure that your computer is 100% virus and spyware-free? Run
through this troubleshooting steps to make sure:

1) Scan in Safe Mode with current version (not earlier than 2003)
antivirus using updated definitions;

2) remove spyware with Spybot Search & Destroy
(www.safer-networking.org) and Ad-aware (www.lavasoftusa.com). These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from
http://www.intermute.com/spysubtract/cwshredder_download.html. I would
not install the other Intermute programs, however. Alternately, there
are CoolWebSearch malware removal steps at
http://www.silentrunners.org/sr_cwsremoval.html. A combination of
HijackThis and About:Buster (http://www.majorgeeks.com) works well in
removing homepage hijackers. Always read the instructions before
running a spyware removal tool. Be sure to update these programs before
running, and it is a good idea to do virus/spyware scans in Safe Mode.
Make sure you are able to see all hidden files and extensions (View tab
in Folder Options);

3) If you are running Windows ME or XP, you should disable/enable System
Restore because malware will be in the Restore Points. With ME, you
must disable System Restore completely. With XP, you can delete all but
the most recent (presumably clean) System Restore point from the More
Options section of Disk Cleanup (Run>cleanmgr).

4) make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update;

5) run a firewall.

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

[Lynn Oliver]

I'm sure my computer is virus and spyware free. I have a Linksys router
that provides a firewall and I run McAfee personal firewall on the system
itself. I scan regularly with Lavasoft Ad-aware 6 and McAfee antivirus.

Any other ideas?

Lynn

[Malke]

Lynn Oliver wrote:

> I'm sure my computer is virus and spyware free. I have a Linksys
> router that provides a firewall and I run McAfee personal firewall on
> the system
> itself. I scan regularly with Lavasoft Ad-aware 6 and McAfee
> antivirus.
>
> Any other ideas?
>
> Lynn

Do you have anything in the dial-up connections area of Internet
Properties (under "Connections" tab)? If so, make sure you've checked
"Never dial a connection".

The next time the dial up box comes up, check in Task Manager to see
what programs and processes are running. *Something* must be calling
this.

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

[Chuck]

On Fri, 12 Nov 2004 20:25:46 -0800, "Lynn Oliver" > wrote:

>I'm sure my computer is virus and spyware free. I have a Linksys router
>that provides a firewall and I run McAfee personal firewall on the system
>itself. I scan regularly with Lavasoft Ad-aware 6 and McAfee antivirus.
>
>Any other ideas?
>
>Lynn

Lynn,

If your computer is for sure 100% spyware and virus free (and if you're only
using AdAware and McAfee for protection, this is NOT a given), you might want to
see what is trying to access the internet when these mysterious connection
attempts happen.

Get Port Explorer (free) from
<http://www.diamondcs.com.au/portexplorer/index.php?page=home> to show you what
network connections your computer is opening, and what processes are opening
them.
And Process Explorer (free) from
<http://www.sysinternals.com/ntw2k/freeware/procexp.shtml>. Provides way more
information than Task Manager.

If you start Port Explorer before one of these connection attempts happens, and
enable the packet log, you will be able to see what process tries to connect to
the internet, and where it is trying to connect. Process Explorer will then let
you learn all about the process(es) you find of interest.

But you might want to keep an open mind, and try some of the other diagnostic
products that Malke has suggested. AdAware is not the only tool to diagnose
every case of spyware infection, and sometimes not even the best one.
Successful spyware protection frequently requires multiple tools.

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

[Lynn Oliver]

> But you might want to keep an open mind, and try some of the other
> diagnostic
> products that Malke has suggested. AdAware is not the only tool to
> diagnose
> every case of spyware infection, and sometimes not even the best one.
> Successful spyware protection frequently requires multiple tools.

I did run Spybot Search & Destroy and CWShredder along with Ad-aware, and
the problem remains. I'll see if I can determine what exactly is making the
call.

I just now deleted MSN connection manager as well.

Thanks,
Lynn

[Chuck]

On Sun, 14 Nov 2004 12:16:48 -0800, "Lynn Oliver" > wrote:

>> But you might want to keep an open mind, and try some of the other
>> diagnostic
>> products that Malke has suggested. AdAware is not the only tool to
>> diagnose
>> every case of spyware infection, and sometimes not even the best one.
>> Successful spyware protection frequently requires multiple tools.
>
>I did run Spybot Search & Destroy and CWShredder along with Ad-aware, and
>the problem remains. I'll see if I can determine what exactly is making the
>call.
>
>I just now deleted MSN connection manager as well.
>
>Thanks,
>Lynn
>

Lynn,

A final step is to run HijackThis, and get expert advice.

HijackThis <http://www.majorgeeks.com/download.php?det=3155>

Create a separate folder for HijackThis, such as C:\HijackThis - copy the
downloaded file there.

Then, run HijackThis ("Scan"). Do NOT make any changes immediately. Save the
HJT Log.
<http://forums.spywareinfo.com/index.php?showtopic=227>
<http://forums.spywareinfo.com/index.php?showtopic=11150>

Finally, have your HJT log interpreted by experts at one or more of the
following security forums (and please post a link to your forum posts, here):
Aumha: <http://forum.aumha.org/index.php>
Net-Integration: <http://forums.net-integration.net/>
Spyware Info: <http://forums.spywareinfo.com/>
Spyware Warrior: <http://spywarewarrior.com/index.php>
Tom Coyote: <http://forums.tomcoyote.org/>

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.