XP SP2 Causes internet connection to fizzle out.

[ridingthru]

Hi
I had Windows XP pro SP1 running on my computer which had a USB ISDN modem connecting it to the internet, the connection was reliable. I installed SP2 and was able to connect to the internet, the connection was slow and by the fourth web page I tried to look at it had stopped altogether. If I disconnect then reconnect I can look at another 2 or 3 pages. If the first page I look at has a download I am able to get it even if it is large. Even once I cannot browse the connection still appears to be open with a steady stream of data running both in and out. I have run Adaware, Spybot and Mcafee and there was nothing to report either before or after installing SP2.
Does anyone know why the ability to browse seems to disappear?

Thanks

 

[RealBlackStuff]

Have you installed any better firewall than the built-in crap from Windows XP?
If not, go get one, e.g. the free Kerios or Sygate or Agnitum Outpost.
You should perhaps also look at my post here and post a hijackthis.txt file with the txt extension.
How to remove Begin2Search / Coolwebsearch

 

[ridingthru]

Many thanks, I have tried a firewall but that did not fix it. None of the lines you mention in your post appear in the log file but I can't work out how to post it, problem is that it contains urls. Any other thoughts?

 

[RealBlackStuff]

when you reply, go to Advanced mode, then post the hjt.txt as an attachment, no problems with URL.

 

[howard_hopkinso]

Many thanks, I have tried a firewall but that did not fix it. None of the lines you mention in your post appear in the log file but I can't work out how to post it, problem is that it contains urls. Any other thoughts?

Once you have 3 posts then you will be able to post urls.

To post your HJT log once you have written your post, in additional options select manage attatchments, and browse to where your HJT log is, click on it then click open then upload.

Regards Howard
:grinthumb

Ps sorry RBS I posted this as you were posting your reply

 

[northernmonkey]

Just a quick question mate, are you running aol? if so, i know there is a sp2 patch available for this problem, just look for aol keyword xpsp2 If your not running aol, then i ain't got the pigging foggiest!

Regards, Monkey!

 

[ridingthru]

Sadly I am not on AOL. This is the log file...

Thanks for looking.

 

[RealBlackStuff]

Boot into Safe Mode.
Using Taskmanager (ctrl-alt-del), try to KILL this program:
C:\WINDOWS\system32\defragfat34.exe

If YOU installed Winproxy and the XP Power utility Taskswitch, then I assume they are OK.
Otherwise "fix" them with HJT now, and UNinstall/delete afterwards.

Run HJT on its own, and let it "fix":

R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Windows DLL Loader] C:\WINDOWS\system32\defragfat34.exe (this is the baddie)
----------- for these 3, see note above -------------
- O4 - HKLM\..\Run: [Winproxy Personal] winproxy.exe
- O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\System32\taskswitch.exe
- O4 - HKLM\..\RunServices: [Winproxy Personal] winproxy.exe
----------- see above -------------------------------
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1104431311369


When done, delete C:\WINDOWS\system32\defragfat34.exe

 

[ridingthru]

Ok Done all that. Could not find windows/system32/defragfat34.exe, in that directory I only found a defrag.exe and defragfat34.exe in windows/prefetch.
A window called defragfat34 had been opening at startup and it isn't now so fixing in HJT has done the trik in that case. Sdaly however after going onto the internet and looking at about 5 pages the "this page cannot be displayed" message started to appear again. there was still a constant flow of data over the connection though. Don't know how relevant this is but I tried to ping various things before I could not browse and all except DNS server worked.
If you have any further thought I would be very grateful.

 

[RealBlackStuff]

Boot into Safe Mode.
Switch off Restore points (don't know how, but you probably do; I run Windows 2000).
Then delete all your Restore points.
Check with HJT if that defragfat34 is there. Kill it again as before, and make sure you you delete it from everywhere.
Clean out your Temp files as described in my "How to.." post.
I hope you are using Firefox.
Post another HJT-log.

 

[ridingthru]

Hi
I've emptied temp and deleted restore points, Defragfat34 is no longer there so it must have been killed last time.
I am in the process of getting firefox
in the mean time, here is the log.
Really appreciate your help

 

[RealBlackStuff]

I think the culprit may be this Winproxy.
Uninstall it and see what happens. You can always re-install it if you need it (what for?)
Could this be another victim-program of XP-SP2?
Maybe an update for winproxy?

 

[ridingthru]

Killing winproxy has made no change, in fact I can now only get to 2 web pages before needing to restart when before I could get to about 6. I have conceeded that I am a victim of SP2 and am consequenly uninstalling it. Hopefully the security risk to those of us without it will not be too great....
Thanks for your help

 

[RealBlackStuff]

Go here and do a couple of tests: http://www.dnsstuff.com/
Maybe your connection is not what it is supposed to be?