Evening Disconnect problems

[chellemays]

for about the past 6 months after 8:30pm Central Time I get disconnected on dial up. Im done all the typical things, shut off call waiting, checked the line, ive changed my ISP three times and am still having this problem, I've called Compaq, my ISP, and Norton all with no luck. During the day i can stay connected all day long without being disconnected at all. Unfortunately because im in a rural area I am unable to get DSL. Sometimes when i get disconnected my Norton firewall will say a remote system is trying to assess my computer and I will request to block that, but still no use I still get disconnected. Someone at compaq said possibly someone is using my pc as a launchpad since it's always the same times every day. Someone please help if you can I am at my wits end with this problem and am not sure where to go for help. I've done a factory restore twice because that was Compaq's suggestion and that didn't work.

 

[stod73]

Damn that's weird! This is a pretty non-technical answer but you could adjust your system clock back so that gave you more time connected. Just a thought....

 

[BillC]

Help me understand. Are you saying that at exactly 8:30 pm every night you lose your connection to the internet ? Just for kicks, I'd try to ping my ISP to see if there is still some type of connection.

Can you reconnect after a peroid of time? A puzzle is this!

 

[skyman]

Do this:


CONTROL PANEL/MODEMS/CONNECTIONS/EXTRA SETTINGS/DELETE WHAT IS THERE AND ENTER: s10=60(no spaces)

This may keep you connected...

 

[raybro]

Have you ran a spyware scan. Spybot S&D is a good one http://spybot.safer-networking.de/ Be sure to do the update before scanning. There is also Adaware http://www.lavasoftusa.com/support/download/ . Some use both to be thorough. I've found Spybot to be adequate.

I've no reason to believe this to be spyware related, just covering the base.

Since you mention Norton I assume you have ran an AV system scan with the latest definitions.


You may also want to consider D/L and running a scan with HighJackThis http://www.tomcoyote.org/hjt/ and posting the log here for review by others who are really good at interpreting the log.

HTH

 

[chellemays]

here is the results of my hijack this, everyone says it appears everything is ok, lastnite i ran the spyware program and was still having problems. i have been through the ringer with everyone trying to figure out why im only having problems at night, i know it's not the isp because i've had problems with all 3 i've used, and my phone line has been checked and it's ok. when i use my laptop i stay connected so whatever it is it's tied to my personal pc.


Logfile of HijackThis v1.96.4
Scan saved at 10:07:17 PM, on 9/9/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
C:\WINDOWS\System32\Smtray.exe
C:\WINDOWS\System32\pctspk.exe
C:\WINDOWS\System32\S3tray2.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\COMPAQ\CPQINET\CPQInet.exe
C:\WINDOWS\System32\hphmon03.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\HPHipm09.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\PROGRA~1\NORTON~3\NORTON~1\navw32.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Documents and Settings\Michelle Mays\My Documents\vr.exe
C:\WINDOWS\System32\jview.exe
C:\Documents and Settings\Michelle Mays\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.consolidated.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.fastaccess.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer by ICTC
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [Smapp] Smtray.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MoneyStartUp] c:\Program Files\Microsoft Money\System\Money Startup.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: Trace (HKLM)
O9 - Extra 'Tools' menuitem: VisualRoute Trace (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Support (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.fastaccess.org
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.c...7870.9099652778
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/Sh...n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tec...ta/SymAData.dll
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tec.../ActiveData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1AD60A64-CACE-4037-900A-61D97296E8AB}: NameServer = 216.176.95.129 216.176.95.161
O17 - HKLM\System\CS1\Services\Tcpip\..\{1AD60A64-CACE-4037-900A-61D97296E8AB}: NameServer = 216.176.95.129 216.176.95.161

 

[raybro]

I'm ceratinly no expert on HJT, but nothing jumps out at me. Perhaps someone with more expertise will chime in on that matter.

This is a real brain teaser, to say the least. Some troubleshooting steps I would consider were it happening on my PC.

Shut off all startup progs in msconfig except systray and explorer.

Do a Registry clean. jv16 is an excellent tool for this. http://www.freedownloadscenter.com/Reviews/r893.html

Disable Task Manager completely .

Shut down (or even uninstall) Norton Internet Security.

Last gasp... Reformat the drive (bummer)

Can't think of anything else at the moment, but if I do I'll post again.

BTW... Welcome to TSG

 

[chellemays]

thanks i will give them a shot. Yes definitely if you think of anything else please let me know. Thanks for all your help

 

[~Candy~]

O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

Just for fun, try disabling that via start button, run, then type msconfig and press enter....go to the startup tab, uncheck it then restart.

 

[chellemays]

thanks i will give that a try

 

[jbredmound]

O17 - HKLM\System\CCS\Services\Tcpip\..\{1AD60A64-CACE-4037-900A-61D97296E8AB}: NameServer = 216.176.95.129 216.176.95.161
O17 - HKLM\System\CS1\Services\Tcpip\..\{1AD60A64-CACE-4037-900A-61D97296E8AB}: NameServer = 216.176.95.129 216.176.95.161


My take is that these are domain hijackers and should be deleted.

Start HJT, check these and have HJT fix them (make sure that all browser windows are closed).

Might actually be your problem.

 

[chellemays]

ok i will run the hjt and check those and hopefully that will help, hopefully that will solve the problem.

 

[chellemays]

ok im still having my nightly disconnect problem after 8:30 I made all the changes suggested. and last nite and tonite i have received OVER 300 high risk tcp inbound udp attempts warnings from norton. all the remote addresses are different but the locals addresses are the same they are only from 2 different ip numbers. could this having have anything to do with my problem? I changed my alert level and now i am seeing all these requests? i removed all of what was suggested and no help still disconnected every few minutes after 8:30.

 

[Rollin' Rog]

I would say the alerts are meaningless. For one, you do not have a "fixed" IP (we can see it), it changes every time you connect to the internet, so no one can be targeting you in particular. Moreover your firewall should be making you effectively "invisible" as far as intruders are concerned.

Try the modem troubleshooter here:

http://modemsite.com/56k/tshoot.asp

The recommended initialization string:

s10=60

might help. Open the Device Manager, find your Modem, double click to get to Properties > Advanced, and try entering it in the extra settings field.

 

[panzer999]

Any way you can change your dial-up password?

I've tried having two different computers dial into a single dial-up account...had problems like you are discribing. Any way someone could have gotten your username/password off your computer somehow?

Sounds like someone might be wanting to surf after homework gets done ever night

Not saying this IS the problem, just something to consider.

Good luck.