Computer pros needed once more

[Newc]

Ok, lately I've been experiencing a strange phenomenon when my screensaver kicks in, or rather, when it's been running and when I bring it out of screensaver mode.

First, when the SS is running (even on low-powered ones like Beziers, Starfield, and Marquee) the speed is literally a snail's pace - like there's something using up ALL the RAM and slowing down the screensaver.

Second, when I move the mouse to wake it back up, everything (including the ss) moves very slowly until the ss is completely shut down.

The strange part is that if I unplug my wireless USB modem (Linksys WUSB11 v2.6), everything runs fast as lightning like it should [img]graemlins/scratchhead.gif[/img]

The only other time I've experienced this sort of thing on this computer is when I'm transferring files to and from my laptop via the wireless home network I've got setup, but the laptop's not connected - it's still in the bag in the corner.

So, I'm assuming I've got something in my system that's either transferring files when the ss kicks in, or something else is seriously wrong.

Anyone know of anything that scans all your ports and stuff? Usually I keep IE and OE open, but OE is not set to automatically check mail. I've had to disable ZoneAlarm because there's something about the new version that doesn't let me connect to the JCF all the time, and you should see how many cgi gif bugs are in one Ebay page [img]graemlins/laugh.gif[/img]
It looks like an invasion [img]graemlins/laugh.gif[/img]

P4 2.8GHz, 512 RAM, 460 GB of disc space over 4 drives, so I know it's not the computer [img]graemlins/laugh.gif[/img]

Newc

[Evol]

Re: Computer pros needed once more

The Dos command 'netstat -a' will show you all active connections...if it only does it when the USB modem is plugged in does it do the same thing when other USB devices are plugged in as well? If so then I would try to find an updated USB driver for your Motherboard,if not then I would try updateing the modems drivers.
Or you could have a Trojan which is sending info out like mad,netstat will confirm this usually.

[Newc]

Re: Computer pros needed once more

Thanks. How will I know what's legit and not?

Here's what it gave me:

</font><blockquote><font size="1" face="Verdana, Helvetica, sans-serif">code:</font><hr /><pre style="font-size:x-small; font-family: monospace;"> Proto Local Address Foreign Address State
TCP dr-newcenstein:echo dr-newcenstein:0 LISTENING
TCP dr-newcenstein:discard dr-newcenstein:0 LISTENING
TCP dr-newcenstein:daytime dr-newcenstein:0 LISTENING
TCP dr-newcenstein:qotd dr-newcenstein:0 LISTENING
TCP dr-newcenstein:chargen dr-newcenstein:0 LISTENING
TCP dr-newcenstein:epmap dr-newcenstein:0 LISTENING
TCP dr-newcenstein:microsoft-ds dr-newcenstein:0 LISTENING
TCP dr-newcenstein:1025 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:1033 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:1039 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:4313 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:4878 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:4883 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:5000 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:1038 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:1039 localhost:2970 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:2972 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:2975 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:2979 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:2986 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:2995 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:2996 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:2998 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3000 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3002 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3003 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3005 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3010 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3022 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3026 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3027 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3043 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3044 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3046 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3052 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3062 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3064 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3066 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3067 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3072 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3148 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3150 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3153 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3160 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3169 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3172 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3174 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3175 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3176 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3179 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3208 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3210 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3211 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3226 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3232 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3234 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3245 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3247 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3256 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3259 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3263 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3264 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3277 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3279 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3280 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3281 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3282 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3285 FIN_WAIT_2
TCP dr-newcenstein:1039 localhost:3286 FIN_WAIT_2
TCP dr-newcenstein:netbios-ssn dr-newcenstein:0 LISTENING
TCP dr-newcenstein:4313 www.chicagowebs.com:http ESTABLISHED
TCP dr-newcenstein:10772 dr-newcenstein:0 LISTENING
UDP dr-newcenstein:echo *:*
UDP dr-newcenstein:discard *:*
UDP dr-newcenstein:daytime *:*
UDP dr-newcenstein:qotd *:*
UDP dr-newcenstein:chargen *:*
UDP dr-newcenstein:snmp *:*
UDP dr-newcenstein:microsoft-ds *:*
UDP dr-newcenstein:isakmp *:*
UDP dr-newcenstein:1032 *:*
UDP dr-newcenstein:1040 *:*
UDP dr-newcenstein:1041 *:*
UDP dr-newcenstein:1042 *:*
UDP dr-newcenstein:1043 *:*
UDP dr-newcenstein:1044 *:*
UDP dr-newcenstein:1045 *:*
UDP dr-newcenstein:1046 *:*
UDP dr-newcenstein:1047 *:*
UDP dr-newcenstein:1048 *:*
UDP dr-newcenstein:1049 *:*
UDP dr-newcenstein:1645 *:*
UDP dr-newcenstein:1646 *:*
UDP dr-newcenstein:l2tp *:*
UDP dr-newcenstein:radius *:*
UDP dr-newcenstein:radacct *:*
UDP dr-newcenstein:ntp *:*
UDP dr-newcenstein:1034 *:*
UDP dr-newcenstein:1035 *:*
UDP dr-newcenstein:1136 *:*
UDP dr-newcenstein:1185 *:*
UDP dr-newcenstein:1900 *:*
UDP dr-newcenstein:ntp *:*
UDP dr-newcenstein:netbios-ns *:*
UDP dr-newcenstein:netbios-dgm *:*
UDP dr-newcenstein:1900 *:*
UDP dr-newcenstein:9718 *:*
UDP dr-newcenstein:59035 *:* </pre><hr /></blockquote><font size="2" face="Verdana, Helvetica, sans-serif">Newc

[slo100]

Re: Computer pros needed once more

Hmmm, that's a lot! Are you running any kind of firewall/security measures?

Also, have you downloaded and ran Spybot before?

I don't think you should have that many UDP connections open. In fact I don't believe you any to run normal applications. I check mine now and then and I usually have just a few and they are all TCP ports open.

What is your OS? Are you just browsing the net or do you have any other applications open?

I believe many trojans run over UDP so that could be a telltale sign.

The first time I ran Spybot I was amazed at all the crap it found (and cleaned up!).

[Newc]

Re: Computer pros needed once more

Yeah I run Spybot regularly (once a week or so), and it's fully updated. I've gone through and shut down all my Shared folders (unShared them) that I use to transfer files to and from my laptop, and it appears to have helped. Did that before running nestat.

I've got ZoneAlarm installed, but currently have it disabled, thinking it was causing the trouble.

Also, I received a strange error/warning when diabling the Sharing on one folder. It said "this Share was created for Administrative purposes, and will be re-activated when the server/service is stopped and restarted". None of my System Drive's folders were Shared - this was on a secondary drive where I keep all the stuff I don't want to have to re-install every time I upgrade.

Lemme reboot and see what happens. If you don't hear from me, I'm out buying a new PC [img]graemlins/laugh.gif[/img]

Newc

[audiophile]

Re: Computer pros needed once more

The admin purposes share is for c$, d$ etc.
xp root drives are always shared. Noone can see them, they are hidden (if you share any folder and add the $, it will be a hidden share)


Funny eh, it's not shared, but it is. So technically, if both are (XP) same login/pwd, no need to 'share' anything. From the laptop, browse to \\dr-newcenstein\c$. There will be that pc's c drive. Read & write access.
I think, been awhile since I set my 3pc lan up.

I don't see anything outta the ordinary, most looks like it is clearing itself from recent activity. After closing all web apps, recheck in 5 minutes, most will have dissappeared (they delay). Still tho, you have some entries that I don't have, need a good pause from traffic then netstat

[audiophile]

Re: Computer pros needed once more

Also, sounds like Zone Alarm is cookie killin, which is logging you outta the JCF every page refresh.

Also, does your Linksys have a firewall built in? After gettin my (hardwire) Linksys Router up, I never saw anything get through for Zone to even catch, and threw Zone out the window. Just a resource hog if it's not really doing anything.


Eh, I'm no help. All I know is when I format, my shit runs fast as hell haha, but over time, glug glug glug.

[audiophile]

Re: Computer pros needed once more

Oh and port scanning here
https://www.grc.com
can also manually pick port ranges to scan
wanna be all stealth

[Newc]

Re: Computer pros needed once more

</font><blockquote><font size="1" face="Verdana, Helvetica, sans-serif">code:</font><hr /><pre style="font-size:x-small; font-family: monospace;">Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Matt Newcomb&gt;netstat -a

Active Connections

Proto Local Address Foreign Address State
TCP dr-newcenstein:echo dr-newcenstein:0 LISTENING
TCP dr-newcenstein:discard dr-newcenstein:0 LISTENING
TCP dr-newcenstein:daytime dr-newcenstein:0 LISTENING
TCP dr-newcenstein:qotd dr-newcenstein:0 LISTENING
TCP dr-newcenstein:chargen dr-newcenstein:0 LISTENING
TCP dr-newcenstein:epmap dr-newcenstein:0 LISTENING
TCP dr-newcenstein:microsoft-ds dr-newcenstein:0 LISTENING
TCP dr-newcenstein:1025 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:1026 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:1027 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:pptp dr-newcenstein:0 LISTENING
TCP dr-newcenstein:5000 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:1043 dr-newcenstein:0 LISTENING
TCP dr-newcenstein:netbios-ssn dr-newcenstein:0 LISTENING
TCP dr-newcenstein:8315 dr-newcenstein:0 LISTENING
UDP dr-newcenstein:echo *:*
UDP dr-newcenstein:discard *:*
UDP dr-newcenstein:daytime *:*
UDP dr-newcenstein:qotd *:*
UDP dr-newcenstein:chargen *:*
UDP dr-newcenstein:snmp *:*
UDP dr-newcenstein:microsoft-ds *:*
UDP dr-newcenstein:isakmp *:*
UDP dr-newcenstein:1028 *:*
UDP dr-newcenstein:1040 *:*
UDP dr-newcenstein:1059 *:*
UDP dr-newcenstein:1060 *:*
UDP dr-newcenstein:1064 *:*
UDP dr-newcenstein:1065 *:*
UDP dr-newcenstein:1066 *:*
UDP dr-newcenstein:1067 *:*
UDP dr-newcenstein:1068 *:*
UDP dr-newcenstein:1069 *:*
UDP dr-newcenstein:1070 *:*
UDP dr-newcenstein:1645 *:*
UDP dr-newcenstein:1646 *:*
UDP dr-newcenstein:l2tp *:*
UDP dr-newcenstein:radius *:*
UDP dr-newcenstein:radacct *:*
UDP dr-newcenstein:ntp *:*
UDP dr-newcenstein:1029 *:*
UDP dr-newcenstein:1030 *:*
UDP dr-newcenstein:1084 *:*
UDP dr-newcenstein:1900 *:*
UDP dr-newcenstein:ntp *:*
UDP dr-newcenstein:netbios-ns *:*
UDP dr-newcenstein:netbios-dgm *:*
UDP dr-newcenstein:491 *:*
UDP dr-newcenstein:1900 *:*
UDP dr-newcenstein:14768 *:*
UDP dr-newcenstein:54495 *:*

C:\Documents and Settings\Matt Newcomb&gt;</pre><hr /></blockquote><font size="2" face="Verdana, Helvetica, sans-serif">Ok, I shut down, restarted, updated ZA, went truckin around the net [img]graemlins/laugh.gif[/img]

If I check my My Network Places, I still see a drive that I disabled Sharing on, and the folder (and none of the subfolders) show the Sharing icon.

Newc

[jackson1]

Re: Computer pros needed once more

So, is problem fixed or..?

/Henrik

[Newc]

Re: Computer pros needed once more

Don't know - I forgot to re-activate the screensaver [img]graemlins/laugh.gif[/img]

Been playing that "escape the room" game, plus cleaning up the house [img]graemlins/laugh.gif[/img]

And sorry for the double-post - somebody delete that. I think ZoneAlarm was screwing around again and I shut it down in the middle of the transfer (my screen never changed), so I then tried to click out of it back to the Forum listing, but got busy with cleaning while I waited for it to reload. By then it was too late to edit it [img]images/icons/frown.gif[/img]

Newc

[hippietim]

Re: Computer pros needed once more

what processes are running? i'd like to get a debugger on your system.

[SeventhSon]

Re: Computer pros needed once more

doing more research...

[ July 02, 2004, 03:17 AM: Message edited by: SeventhSon ]

[Newc]

Re: Computer pros needed once more

Tim - Here's a screenshot of what's running now:



Newc

[Cleveland Metal]

Re: Computer pros needed once more

There are some major problems with Version 5 which are causing conflicts with most of the major virus softwares, slow or no loading of webpages, programs freeze or won't open, windows won't open, blue screen, erratic reboots and a ton of other ill stuff. It will do this just being on the system, even turned off.

They know about it, and have offered the old program as a link till they fix it. It's all overthe zonealarm forums.

TOTALLY uninstall that new ver 5.0 zone alarm using control panel and re-install version 4.5 through the following link:

http://download.zonelabs.com/bin/fre...45_594_000.exe

IF, this started after you loaded the new ZA update, I bet you will see your problem fixed