[SOLVED] VERY slow DSL...HJT log enclosed

[brushmaster1]

My BellSouth Fast Access DSL has recently slowed to the point where I can surf faster with dial-up. This seems to affect only surfing; dowmload speeds are about normal. However, it takes practically forever for a web page to load and even after the page loads, it can take up to 30 minutes for all images to load (if ever).

I have run a virus scan (AVG), Spybot, and AdAware, manually deleted all TIFs and cookies, and double-checked all my internet settings, all to no avail.

Here is my HJT log...perhaps someone will see something I've missed.


Logfile of HijackThis v1.97.7
Scan saved at 8:47:23 PM, on 4/12/04
Platform: Windows 98 SE (Win9x 4.10.2222B)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\GRXP4EXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\NUTS & BOLTS\COMDLGEX.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\OMNIQUAD\OMNIQUAD PERSONAL FIREWALL\OPF.EXE
E:\WINDOWBLINDS\WBLOAD.EXE
D:\WEBSHOTS\WEBSHOTSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
E:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bellsouth.net/
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Program Files\Netscape\Users\wintersatin\prefs.js)
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - E:\FreshDL\fdcatch.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Microsoft IntelliType Pro] "C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [NB Start Menu] C:\PROGRA~1\NETWOR~1\NUTS&B~1\STARTM.EXE
O4 - HKLM\..\Run: [NB Common Dialog Enhancements] C:\PROGRA~1\NETWOR~1\NUTS&B~1\COMDLGEX.EXE
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [3dfx Tools] rundll32.exe 3dfxCmn.dll,UpdateRegSettings
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [EppieDesktop] RUNDLL32.EXE C:\WINDOWS\SYSTEM\EPSHELL.CPL,RUNDLL_EpIn
O4 - HKCU\..\Run: [OPF] C:\PROGRAM FILES\OMNIQUAD\OMNIQUAD PERSONAL FIREWALL\OPF.EXE
O4 - HKCU\..\Run: [WindowBlinds] E:\WindowBlinds\wbload.exe auto
O4 - Startup: Webshots.lnk = D:\Webshots\WebshotsTray.exe
O4 - User Startup: Webshots.lnk = D:\Webshots\WebshotsTray.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - E:\INCRED~1\bin\WebMenuImg.htm
O8 - Extra context menu item: Download with &FD - file://E:\FRESHDL\fdiectx.htm
O8 - Extra context menu item: Download &All by FD - file://E:\FRESHDL\fdiectx2.htm
O8 - Extra context menu item: Download Links As... - file://C:\WINDOWS\SYSTEM\page.htm
O8 - Extra context menu item: Download Target(s) As... - file://C:\WINDOWS\SYSTEM\link.htm
O8 - Extra context menu item: Download using LeechGet Wizard - file://C:\Program Files\LeechGet 2003\\Wizard.html
O8 - Extra context menu item: Download using LeechGet - file://C:\Program Files\LeechGet 2003\\AddUrl.html
O8 - Extra context menu item: Parse with LeechGet - file://C:\Program Files\LeechGet 2003\\Parser.html
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\wweb32.dll/lookup.html
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O12 - Plugin for .MPG: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0727.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37863.4528587963
O16 - DPF: DigiChat Applet - http://www.elitegold.com/DigiChat/DigiClasses/Client_IE.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) -
O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.fastaccess.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

 

[brushmaster1]

I just noticed a couple of running processes listed that I'm not familiar with;

C:\WINDOWS\SYSTEM\GRXP4EXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE

Does anyone know what these are?

 

[brushmaster1]

An update:

This doesn't seem to be an IE problem; I get the same thing with Mozilla and Opera.

 

[buf]

That happens to my BS DSL just about every afternoon from about 3PM to 5:30PM. I try to ignore it but recently used iChat, or whatever it is called by BS, and was presenting my problem to the "person" on the other end but lost contact. I then sent a c/p of that "conversation" to BS and now after about 5 days, I am still waiting for BS to respond. Something is happening but I can't seem to get answers to my problem. Hope you have success with yours and I am sorry that I can not be of help to you. Just sharing with you a similar problem.
BTW, that slow down is not constant; if comes and goes during those hours. And since this appears to be "unique", let's keep this thread going and share with each other what we learn.

 

[brushmaster1]

Thanks for the response, buf.
I also tried i-chat, but gave up after waiting 30 minutes for the chat window to load. I e-mailed BellSouth, but haven't gotten a response yet.

 

[brushmaster1]

Still no answers?

One more observation:
Download speeds, as stated, seem normal. I get acceptable speeds recorded on several "speedometer" sites, yet the pages on those sites still take forever to load. I am becoming more and more sure that it is a problem with my system rather than a network problem with BellSouth...

 

[buf]

No answers!!! Bellsouth is very slow in answering email inquires.
I checked my speed with a site in LA this afternoon about 4PM DST and I had these readings:875 down/163 up--702 down/161 up--1176 down/161 up
I ran the 3 tests in succession and wouldn't you know it, this afternoon every site I went to seem to load quickly. I have to say though, I do not have any readings when pages/sites were not loading quickly. That is what I will try to remember to do the next time loading is slow. All thinks said, I will still take DSL over dialup---any day and any hour. Could it be that we have had DSL so long now that we "feel" that it is slow at times??
If you find that the problem(s) is/are with your PC, then I hope you are able to find and make the proper corrections quickly.

 

[brushmaster1]

I can't believe that nobody has any suggestions on this problem!

Still waiting.....

 

[mjack547]

As far as your hijackthis log goes I do not see any problems

The three files that you asked about

C:\WINDOWS\SYSTEM\GRXP4EXE.EXE==

Associated with the drivers for Gravis game controllers

C:\WINDOWS\SYSTEM\DDHELP.EXE==

DirectDraw Helper, a part of DirectX and is used for graphics related services

C:\WINDOWS\SYSTEM\PSTORES.EXE==

Microsoft Protected Storage Server, in Win95/98/ME, or Protected Storage Service, in WinNT/2000/XP. Protected Storage, in the form of PSTORES, was introduced with Internet Explorer 4. It is invoked by Microsoft Internet programs, such as Outlook Express and Internet Explorer, to securely store a variety of secure and confidential data into the registry, such as Outlook Express passwords, SSL certificates, auto-complete fields, such as usernames and passwords to enter web sites, and so forth, and web forms data.

 

[brushmaster1]

Thanks for the reply, Mjack. If I had just slowed down and thought about it, I should have known what the first two files were...I had no idea about PSTORES though.

 

[mjack547]

any time glad to help

 

[brushmaster1]

Now if someone could just help me solve the slow browsing problem...

 

[buf]

Was just poking around and came upon this item and thought you may be interested in what is there. Not only at this link but the overall site. Oh, run the tweak test and maybe learn something and there are many tests that can be run from different links. I ran the tweak test and everything was good and only "not pingable" was reported on my AMD machine. Don't know that that should be a negative. Good luck to you!!

http://www.dslreports.com/tweaks

 

[brushmaster1]

Thanks for the link, Buf...I'll check it out.

 

[brushmaster1]

That did the trick! Apparently something had reset my RWIN value. I corrected it and pages are loading properly now.

Thanks again for the link, Buf!