StarDestroyer.Net BBS

A while back I began getting bizarre latency spikes, causing my vent ping to spike up past 20 or 30k. They lasted quite a while. Malwarebytes couldn't find anything, so I grabbed Avast because it was listed under Microsoft's list of free AV...

It found something it dubbed YabectorB, and fixed it. At least I couldn't find any of the files listed under a sites "Manual Removal" steps...

This seemed to fix it for a while. but they've started again. The lock-ups are primarily in video games like TF2, and last 2-3 seconds. Some games continue during this period, some don't... May or may not be unrelated.

Tried to join that support forum in the sticky, but they never sent out the Admin email.

----------
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:16:56 AM, on 12/25/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\ctfmon.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [HDAudDeck] "C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" -r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files (x86)\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files (x86)\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - Unknown owner - c:\program files (x86)\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe (file missing)
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7629 bytes


It -might- just be my wireless network card dying, as my mouse is decidedly on it's way out. There's decidedly little I've found for monitoring my own computer's network connections...

First you need to determine the cause of your latency. It could be either hardware based (overheating, bad hd, etc), software based (virus, program eating resources in background), or the network based (packet loss from wifi or ISP). I'd check network, then hardware, then software.

For network run a Ping Test to check your latency. Test this at different times and places if you move your computer around. The test should show you if you have packet loss or latency issues. I also like to ping /t Google and my local router when I have network issues as it helps me determine if its a local or remote problem. If you are getting latency on wireless test what you're doing with a wired connection and if that is fine consider running cable, upgrading the router or getting a wireless repeater.

For hardware, find a temperature monitor that works on your computer. There are quite a few of them and motherboard support may vary. I've known many systems to lock up because of overheating. Run the monitor so that it logs the low/avg/high temperature of each component. I would also check to see if during your lockups your hard drive light is active. Previously I had a bad hard drive that would lock up the computer during some disk reads and writes. If you think your hard drive is at fault, I would suggest testing it under Ubuntu (unsure of any windows utility) to check if the disk is about to fail.

For software run a boot time scan with Avast and check the ram/cpu usage of the processes in task manager. Viruses can cause computer slowdown but I don't think many cause system lock-ups. You might also consider reinstalling your OS if you haven't done that in a few years. I know I tend to every year if not less.

Check your CPU load during idle. I had a similar thing a few days ago. Turned out to be some kind of a nasty critter, can't remember it's name though. Avira took care of it though.

It may still be a hardware case though, so do what TronPaul is telling you to do.

If you think your hard drive is at fault, I would suggest testing it under Ubuntu (unsure of any windows utility) to check if the disk is about to fail.

piriform's defraggler has a HDD testing feature.

crystaldiskinfo is another good one.

Gah, I always forget something.


Related to the latency: During the spikes, which last 2-3 minutes and usually happen at late at night, several times, I'm unable to even reach my routers ip. If it were hardware, I'd expect a slightly more random time frame, but it's almost always between 2-6AM. I had thought it fixed because for a while my sleep cycle resembled a normal human being's.

I've several times found 'conime.exe' under the processes tab. And RpcSs/908/Remote Procedure Call (RPC)/Running/rpcss under the Services tab. I've never paid enough attention to the services tab to know if these should be running. This site had a guy suggesting just nuking the entire service.dll, but I haven't seen the other two programs he mentions running.

Either way, it's looking like I should just back-up and wipe.

As for ping test, and part of the reason I haven't just nuked the problem from orbit, is that my cable tops out at 0.72mb/s down and 0.1 up...

Andrew_Fireborn wrote: As for ping test, and part of the reason I haven't just nuked the problem from orbit, is that my cable tops out at 0.72mb/s down and 0.1 up...

Those speeds, are they in megabits, or megabytes?

What router and wireless card do you have? How far away are you from your router, ie how many walls/floors/ceilings are between your computer and router? During the spikes and lock ups are you able to use local software while the software using the network is lagging? Have you updated your wifi drivers or router firmware?

If it's a signal issue, you might consider getting an external antenna if your card is a regular desktop card. An external antenna can let you get an optimal signal without moving your computer. They run from 15 to 30 dollars.

1 floor, somewhat of a wall or two, if I were to draw a straight line. Though it's basically only 5 meters away from it, tops. Comp is actually using a belkin usb, I should upgrade to a full card but it served well enough. Router is also Belkin. Router frontpage lists the model as F5D7234-4 v1000. Signal strength is usually listed at 4 bars on the windows network tray icon.

My downloads for actual files tends to be about sit at 81kb/s, peaking at 120kb/s rarely. This is the same at the computer that is actually plugged into the router, so that's a line issue. Speedtest's speeds are in bits/second. Pingtest itself "failed" the packet loss, but still gave the line a B* rating...


Defraggler found nothing wrong with the HDD.

Then it sounds like it might be a network issue involving packet loss. Packet loss is probably the biggest cause of lag for wireless networks.
What speeds are you supposed to be getting for your internet? Does your computer plugged into the router pass pingtest's packet loss test? If you plug directly into the modem does your speed/packet loss improve? If it does, then you need a new router. If not, you need to call your ISP. The issue could be something your ISP can and is willing to fix or possibly it won't. If the latter consider changing your plan to match the actual service you get, or switching providers.

I recently identified a wireless printer as a significant cause of major bandwidth hogging on my home network. When troubleshooting network issues, especially wireless, don't forget to consider other devices as potential sources of problem as well. I went through and turned off the wireless for all my cellphones, Ipad, and it wasn't until I turned off the printer that my network utilization normalized. Usually your wireless router will have a page in it's configuration that displays all connected devices. This will help you identify anything that can be disconnected for testing. It also can identify anyone that may be connecting to your network unauthorized.

Running Pingtest.net today, from IE it would seem the packet loss was being caused by windows defender or something else blocking the script from sending/receiving the packets in Firefox, after having it allow it, it lost 0% and it has returned identical results to direct line, give or take a few milliseconds.

Slightly higher upstream on the directly line, but only by 0.02~.


I don't think the printer upstairs is wireless, although the router has spit a fair few IP conflicts over the coarse of its life, between the two computers, and three consoles that can all connect to it. Even though it should be assigning from a pool of at least a hundred.

I've also never caught any unknowns on the client list for the router's wireless.

As for the service, I don't pay the bill for it. I've brought it up with the roommate who does, and they're content with the service level and don't want to pay if the ISP tech comes and declares nothing wrong with the line. (Appearently Time Warner Policy.) For my part, it's tolerable, excepting that it takes a day to download a 5gig game through steam...

And I've just noticed conime.exe is back up even though I killed it earlier today before work.
-Gah, this seems to be roundabout. Found file.net saying it's asian character support, and I do have that installed... So, perhaps that's unlikely to be related.