1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Evening Disconnect problems

Discussion in 'Web & Email' started by chellemays, Sep 9, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. chellemays

    chellemays Thread Starter

    Joined:
    Sep 9, 2003
    Messages:
    16
    for about the past 6 months after 8:30pm Central Time I get disconnected on dial up. Im done all the typical things, shut off call waiting, checked the line, ive changed my ISP three times and am still having this problem, I've called Compaq, my ISP, and Norton all with no luck. During the day i can stay connected all day long without being disconnected at all. Unfortunately because im in a rural area I am unable to get DSL. Sometimes when i get disconnected my Norton firewall will say a remote system is trying to assess my computer and I will request to block that, but still no use I still get disconnected. Someone at compaq said possibly someone is using my pc as a launchpad since it's always the same times every day. Someone please help if you can I am at my wits end with this problem and am not sure where to go for help. I've done a factory restore twice because that was Compaq's suggestion and that didn't work.
     
  2. stod73

    stod73

    Joined:
    Aug 13, 2003
    Messages:
    832
    Damn that's weird! This is a pretty non-technical answer but you could adjust your system clock back so that gave you more time connected. Just a thought....
     
  3. BillC

    BillC

    Joined:
    May 28, 2003
    Messages:
    2,366
    Help me understand. Are you saying that at exactly 8:30 pm every night you lose your connection to the internet ? Just for kicks, I'd try to ping my ISP to see if there is still some type of connection.

    Can you reconnect after a peroid of time? A puzzle is this!
     
  4. skyman

    skyman

    Joined:
    Jan 30, 2001
    Messages:
    1,234
    Do this:


    CONTROL PANEL/MODEMS/CONNECTIONS/EXTRA SETTINGS/DELETE WHAT IS THERE AND ENTER: s10=60(no spaces)

    This may keep you connected...
     
  5. raybro

    raybro

    Joined:
    Apr 26, 2003
    Messages:
    5,836
    Have you ran a spyware scan. Spybot S&D is a good one http://spybot.safer-networking.de/ Be sure to do the update before scanning. There is also Adaware http://www.lavasoftusa.com/support/download/ . Some use both to be thorough. I've found Spybot to be adequate.

    I've no reason to believe this to be spyware related, just covering the base.

    Since you mention Norton I assume you have ran an AV system scan with the latest definitions.


    You may also want to consider D/L and running a scan with HighJackThis http://www.tomcoyote.org/hjt/ and posting the log here for review by others who are really good at interpreting the log.

    HTH :D :cool:
     
  6. chellemays

    chellemays Thread Starter

    Joined:
    Sep 9, 2003
    Messages:
    16
    here is the results of my hijack this, everyone says it appears everything is ok, lastnite i ran the spyware program and was still having problems. i have been through the ringer with everyone trying to figure out why im only having problems at night, i know it's not the isp because i've had problems with all 3 i've used, and my phone line has been checked and it's ok. when i use my laptop i stay connected so whatever it is it's tied to my personal pc.


    Logfile of HijackThis v1.96.4
    Scan saved at 10:07:17 PM, on 9/9/2003
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Internet Security\NISUM.EXE
    C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\Program Files\Norton Internet Security\ccPxySvc.exe
    C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
    C:\WINDOWS\System32\Smtray.exe
    C:\WINDOWS\System32\pctspk.exe
    C:\WINDOWS\System32\S3tray2.exe
    C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
    C:\COMPAQ\CPQINET\CPQInet.exe
    C:\WINDOWS\System32\hphmon03.exe
    C:\Compaq\EAKDRV\EAUSBKBD.EXE
    C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
    C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
    C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\WINDOWS\System32\HPHipm09.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Symantec Shared\NMain.exe
    C:\PROGRA~1\NORTON~3\NORTON~1\navw32.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Documents and Settings\Michelle Mays\My Documents\vr.exe
    C:\WINDOWS\System32\jview.exe
    C:\Documents and Settings\Michelle Mays\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.consolidated.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.fastaccess.org
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer by ICTC
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
    O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
    O4 - HKLM\..\Run: [Smapp] Smtray.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe
    O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [MoneyStartUp] c:\Program Files\Microsoft Money\System\Money Startup.exe
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
    O9 - Extra button: Trace (HKLM)
    O9 - Extra 'Tools' menuitem: VisualRoute Trace (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Support (HKCU)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.fastaccess.org
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.c...7870.9099652778
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/Sh...n/bin/cabsa.cab
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tec...ta/SymAData.dll
    O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tec.../ActiveData.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1AD60A64-CACE-4037-900A-61D97296E8AB}: NameServer = 216.176.95.129 216.176.95.161
    O17 - HKLM\System\CS1\Services\Tcpip\..\{1AD60A64-CACE-4037-900A-61D97296E8AB}: NameServer = 216.176.95.129 216.176.95.161
     
  7. raybro

    raybro

    Joined:
    Apr 26, 2003
    Messages:
    5,836
    I'm ceratinly no expert on HJT, but nothing jumps out at me. Perhaps someone with more expertise will chime in on that matter.

    This is a real brain teaser, to say the least. Some troubleshooting steps I would consider were it happening on my PC.

    Shut off all startup progs in msconfig except systray and explorer.

    Do a Registry clean. jv16 is an excellent tool for this. http://www.freedownloadscenter.com/Reviews/r893.html

    Disable Task Manager completely .

    Shut down (or even uninstall) Norton Internet Security.

    Last gasp... Reformat the drive (bummer) :(

    Can't think of anything else at the moment, but if I do I'll post again.

    BTW... Welcome to TSG :rolleyes: :D
     
  8. chellemays

    chellemays Thread Starter

    Joined:
    Sep 9, 2003
    Messages:
    16
    thanks i will give them a shot. Yes definitely if you think of anything else please let me know. Thanks for all your help
     
  9. ~Candy~

    ~Candy~ Retired Administrator

    Joined:
    Jan 27, 2001
    Messages:
    103,706
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

    Just for fun, try disabling that via start button, run, then type msconfig and press enter....go to the startup tab, uncheck it then restart.
     
  10. chellemays

    chellemays Thread Starter

    Joined:
    Sep 9, 2003
    Messages:
    16
    thanks i will give that a try
     
  11. jbredmound

    jbredmound

    Joined:
    Jul 26, 2003
    Messages:
    243
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1AD60A64-CACE-4037-900A-61D97296E8AB}: NameServer = 216.176.95.129 216.176.95.161
    O17 - HKLM\System\CS1\Services\Tcpip\..\{1AD60A64-CACE-4037-900A-61D97296E8AB}: NameServer = 216.176.95.129 216.176.95.161


    My take is that these are domain hijackers and should be deleted.

    Start HJT, check these and have HJT fix them (make sure that all browser windows are closed).

    Might actually be your problem. (y)
     
  12. chellemays

    chellemays Thread Starter

    Joined:
    Sep 9, 2003
    Messages:
    16
    ok i will run the hjt and check those and hopefully that will help, hopefully that will solve the problem.
     
  13. chellemays

    chellemays Thread Starter

    Joined:
    Sep 9, 2003
    Messages:
    16
    ok im still having my nightly disconnect problem after 8:30 I made all the changes suggested. and last nite and tonite i have received OVER 300 high risk tcp inbound udp attempts warnings from norton. all the remote addresses are different but the locals addresses are the same they are only from 2 different ip numbers. could this having have anything to do with my problem? I changed my alert level and now i am seeing all these requests? i removed all of what was suggested and no help still disconnected every few minutes after 8:30.
     
  14. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    I would say the alerts are meaningless. For one, you do not have a "fixed" IP (we can see it), it changes every time you connect to the internet, so no one can be targeting you in particular. Moreover your firewall should be making you effectively "invisible" as far as intruders are concerned.

    Try the modem troubleshooter here:

    http://modemsite.com/56k/tshoot.asp

    The recommended initialization string:

    s10=60

    might help. Open the Device Manager, find your Modem, double click to get to Properties > Advanced, and try entering it in the extra settings field.
     
  15. panzer999

    panzer999

    Joined:
    Jul 14, 2003
    Messages:
    724
    Any way you can change your dial-up password?

    I've tried having two different computers dial into a single dial-up account...had problems like you are discribing. Any way someone could have gotten your username/password off your computer somehow?

    Sounds like someone might be wanting to surf after homework gets done ever night :)

    Not saying this IS the problem, just something to consider.

    Good luck.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/163524

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice