Internet Connection Problem

Hello Sparkstation:

hope you are well............

I have read the info you give on "process Explorer". Having used it can you please advise the following?

Should I download this then get rid of Task Manager. Or get rid of Task Manager then download?

Does it compare directly to Task Manager?

I am thinking it just may find any problems I still have on my computer which are making and window freeze for no apparent reason?

Take care........

Hello babybear

When you have installed the excellent "Process Explorer", you can choose to "Replace Task Manager", and most users do this.

If you later decide (for some odd reason) to uninstall "Process Explorer", then Task Manager arrives back quite OK.

"Process Explorer" is such a good Utility, that Microsoft bought the complete Company, just to get "Process Explorer" under the MS umbrella.

"Process Explorer" is far more useful, and more powerful, than Windows Task Manager.

Kind Regards....

Hello Sparky,

thank you so much for the details. It certainly looks the part. I wonder if Microsoft will replace Task Manager entirely?

I will check it out some more, thanks again...........

Do yo have a wireless router or anything?

With out being properly safeguarded with a purchased internet security suite while using a wireless router your neigbors can easily WiFi straight into your connection and do what ever they want on the internet through your connection and under your IP address.

Kind of scary huh?

Free programs are great but free programs for windows are too widely used and therefore easily hacked.

I suggest Linnux if your worried about security.

No i have not any wireless router connected to my machine...

Thanks......

Sparkstation-

You get a GA from me for recommending Process Explorer, which I have been using for some time. Very definitely the best way to find out what is going on inside. Microsoft has reasons for hiding this information, i.e., the high overhead of Windows Explorer and Internet Explorer. Also great for checking for malware...

Hello cwarner7_11

Thank you.

Yes, Mark Russinovich and a friend started Sysinternals http://www.sysinternals.com and Microsoft got really annoyed as Mark and the Team designed and improved several utilities.

Eventually The Software giant got what it intended, and Sysinternals became part of the Microsoft stable, with the auto-transfer from the sysinternals website direct to http://technet.microsoft.com/en-us/sysinternals/default.aspx

Mark Russinovich and Team now get paid by the Software giant, of course.

Kind Regards....

H!

Here is my feedback...

I can't see anything wrong at process explorer...let me tell u this tool is very nice...Thanks for suggestion..

My prob is intact so i decided to scan my whole system with different antivirus softwares and will try to trace out the problem..And also try anti maleware softwares ..

and it will take 3 to 4 days ...

I will lete here know whatever result is..

Thanks once again...

Regards!!

Sir

You really deserve 5 scores for animation.

try downloading 'Wireshark'. its free. read up on it for details. I use it all the time.

Hello Fireball,

i had faced a similar problem with my PC.

basically there are many softwares which downloads their updates immediately the internet connection is available. also your antivirus software connects to the internet for the latest defination updates. Even the windows update starts automatically.

all these always happen without the notice of the users. some softwares ask the user before downloading and if you click "yes". it will start download.

i would suggest you to put your windows update off from control panel. And check the task manager for the unknown process that starts running as the internet connection is available.

regds

You would appear to have either viruses, a rootkit or malware on your PC. Even formatting is not proof that the HD is clean, or that your "reload" is not infested.

Follow the good advice from Sparstation as a first.

Download and run AdAware and or Spybot Search and Destroy as well.....

For a Rootkit, you need special software....

What software do you have installed to protect your PC? Is it fully upto date?

Hello Andy Germany:

Yes some good advice from Sparky and you.

Because they work in different ways, I downloaded both Spy-bot and Ad-Aware. But had to choose one to keep and get rid of the other.

The choice is complicated by there being a lot of Mal-ware viruses and the like which have the same name as Ad-Aware for sure, and I would think the same is true with Spy-bot.

I used Reg-Cure but found trying to figure out which was the 'bad guy' from the list of (at first) hundreds of apps with very similar names and paths.............I found it too difficult for my small brain!

In the end I copied the name and path of what I knew was the correct apps, and referred to that as I deleted anything Reg-Cure brought up as 'bad'.

I am running Spyware Doctor which includes Anti-Virus. And find it easy to use and it updates just about every hour, and a quick scan takes just 3 minutes. I have it configured to scan on start-up. And it does work.

There will be a time when this software will not find every virus etc. But, at the moment it is fine.

The other thing I want to do is to install Zone Alarm. This puts up another 'fake' browser window over the top of which ever browser being used at present. I have used Zone Alarm before and, it does slow everything down a little, especially at start-up. But, that is better than trying to rid your computer of Trojans and other nasties!

Hello Andy Germany:

you mention "Even formatting is not proof that the HD is clean, or that your "reload" is not infested". But if a completely new re-install is done and a 'scrubber' or 'wiper' software used, this should wipe and or scramble everything on his HDD?

Let me know what you think please, because this is what I will be doing in the future.

Take care..............

I only trust a Linux boot CD format of the hard disk with overwriting and of course rewriting the MBR also under Linux.......that seems to clear everything off the hard disk....!

I like various Linux boot CDs for different jobs, sadly no single one does everything.

For Knoppix, you need to go to FAT32 as it does not like NTFS much, but of course ypou can go back to NTFS once the disk is cleaned when you re-install Windows....

Try CurrPorts by NirSoft (http://www.nirsoft.net/utils/cports.html) - shows you what applications are using what ports. One interesting one is all the ports explorer and messenger open, to ad servers.

Hi all,

I have had my screen freeze a lot recently, and reported it to Microsoft. This is what I got back:

Check out this link for Snoopanalyzer

http://netsecurity.about.com/od/securitytoolprofiles/p/aaprsnoopanlzr.htm

This lets you see what exactlt is being sent out. Follow the diections to install since you need WinPcap installed first.

This will tell you where packets are addressed and what is in them.

Your comp may be only connecting to router and not Internet. Plug directlt to Internet with out router and see if it continues.

Hello compgek:

Thanks, I will have a look into it. Sound pretty good.

At the moment I am being sent a couple of emails everyday which I am pretty sure are a scam. After getting software from PC Tools, it was fine for a month or so, then the emails came. They say I will have to send them details of my payments as the card failed..............

Well, the Software I downloaded was working and is still working just fine. And, after ringing my credit card company they say no payments have been refused, so my first thoughts of it as a scam it seems are correct. I got a computer magazine today and it is mentioned in there, where letters are sent out on spec and maybe 1 or two percent will send details. Of course apart from the personal finance side where the bank could be pilfered, the people sending the letter really want to get into your computer and screw things up.

This is just a warning really...........not to believe anything you get by email which you have not requested!

Regards & thanks for good pots on threats!

Rootkits havebeen reffered to [real-threat] briefly.

I have the honour to add For info for all friends:

RootkitRevealer is also a good tool by sysinternals as very few people scan for Rootkits.

Almost all AV sites have info for latest Rootkits & their scanners.

<http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx>

I am the old user of "sysinternals" before it was owned by

MS after a long war of attrition by the Giant against them.

There are quite a good reason to use "Process Explorer"

& other tools recommended in posts inspite of the reservations

by the following posters.

What the new threat & limitations of removing tools. Please have a look on the posts quoted below :

*** Quote ***

Rootkits--a stealth technology used by malware writers to hide their

creations on your PC--are notoriously difficult to find and purge.

--Erik Larkin in [McAfee Rootkit Detective ]'s notes.

**** Un-Quote ****

*** Quote ***

Jaan

<http://www.codinghorror.com/mtype/mt-comments-renamed.cgi?__mode=red&id=27367>

on June 17, 2007 10:54 PM

I would also consider running RootKitRevealer from sysinternals for those extra sneaky spyware that don't even show up in ProcessExplorer.

<http://www.microsoft.com/technet/sysinternals/utilities/RootkitRevealer.mspx>

Quote Ends:

*** Quote ***

Thomas on June 18, 2007 03:22 AM

+10 for SysInternals RootKit Revealer

I recently had my very first virus in all of 15+ years of computing. There is a mechanism where by which the rootkit installs itself as a service in the registry (HKLM\System\CurrentControlSet\Services\...). It doesn't appear in the task manager, nor could I find it in Process Explorer. The rootkit will actually prevent you from modifying the registry entry either via RegEdit, Win32 API, or Native NT functions. The rootkit in turn, makes sure that a browser helper object is always loaded. Of course I couldn't delete the .sys or .dll files, they were locked and/or the rootkit installed hooks preventing the files deletion.

The only way to clear this infection is to mount the HD onto another machine and remove offending files, or, what I did in the end, create a BartPE windows "live" cd and delete the files that way. Then after booting off the HD, the service wasn't being loaded, and I could repair the registry.

Quote Ends:

*** Quote ***

Joel Coehoorn <http://www.codinghorror.com/mtype/mt-comments-renamed.cgi?__mode=red&id=27436> on June 18, 2007 08:02 AM

Most modern malware incorporates kernel-mode rootkits, which can (and do) easily hide from tools like Rootkit Revealer. Your only chance is to detect them without booting the infected OS - you need a boot CD and knowledge about how things get hidden in the registry and file system.

Some malware hides on the hard drive not in common files, but in alternate data streams, slack space, boot sectors, etc., and are not found by tools running in the OS itself.

It is easy to find *some* malware, and sometimes you can remove it by hand, but the point of a rootkit is that the OS will never tell you about the files, registry locations, etc. that contain the malware.

It is possible for malware to escape to the host system, as shown by research at IntelGuardians.

There are most likely things still on your PC that are hidden much better.

Unfortunately in many cases you'll spend less time formatting and reinstalling your apps than trying to ferret out all the places things can hide.

For info, read www.rootkit.org.

Quote Ends

*** Quote ***

http://www.techsupportalert.com/best_46_free_utilities.htm

....

Rootkits are a special kind of software tool used to hide trojans, viruses and other malware from your anti-virus scanner and other security products. Unfortunately, they are extremely effective which means that some of you reading this will be infected even though you believe your PC to be totally clean. Thankfully there is a new class of security product now available called rootkit detectors that use specialized techniques to detect these dangerous intruders.

Most of these detectors require quite a bit of technical skill to interpret the results ...

**** Un-quote ***

Regards