Internet connection problems?

Thanatos

So, I've been having some internet connection issues since I moved into this apartment. I just assumed it was issues with the ISP in this particular area, since I've been through two different routers, and using the same ISP at my previous place. However, talking with naporeon last night, he insisted it was a virus or spyware of some sort. I run a pretty clean computer, so I think he's very, very wrong, but I figure I'll give you guys a shot at it. I don't see anything suspicious on this Hijack This! log; does anyone else?

Logfile of HijackThis v1.99.1
Scan saved at 2:13:33 PM, on 12/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: CVirtualDNSObj Object - {86C510E9-97EF-4749-914F-0280247BE3A6} - C:\WINDOWS\VirtualDNS.dll
O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

Narian

I sometimes use http://www.hijackthis.de/ to load up a logfile and it tells me what is clean and what isn't.

And it's telling me O2 - BHO: CVirtualDNSObj Object - {86C510E9-97EF-4749-914F-0280247BE3A6} - C:\WINDOWS\VirtualDNS.dll is VERY bad. So is Google.

naporeon

Also, Than, we weren't insisting it was a virus.

The exact message was that the logical first step when you experience network or internet hiccups is to look at security issues. I thought it was funny that you said you were considering switching ISPs, and yet had not even run HijackThis. You can't really claim to run a clean computer if your first impulse on a change in functionality is NOT to examine the processes running on your machine.

First things first, Than. And as you see, you've got at least one questionable item in there.

Thanatos

That would be a URL redirect program for Internet Explorer. I use Internet Explorer once in a blue moon (and only to go to sites that don't work in Firefox), so I don't really see how that would explain my problem, but I'll delete it anyhow.

And nap, like I explained last night, I scan pretty regularly, have a firewall, and haven't seen any behavior other than the internet slowdown (that coincidentally began when I moved to Seattle) that would be at all indicative of any kind of infection.

naporeon

Then my suggestion would be to incorporate process analysis into your security routine. Familiarize yourself with HijackThis (or a similar tool), and monitor your processes on occasion, to prevent this sort of problem from reoccurring. Antispyware and antivirus programs are only part of a vigilant security routine; familiarity with your system should be your first line of defense.

Immediately assuming that a service interruption or slowdown is the responsibility of your ISP--instead of paying closer attention to your machine--is a recipe for disaster.

And as far as your points go:
1. Regular scans - Useful, but not infallible. Familiarity with system processes is arguably more important.
2. Firewall - Completely irrelevant in this case. A firewall stops or throttles traffic. It does not stop the downloading or installation of malicious software on your PC.
3. System behavior - Your perspective may of course differ from my own, but when I notice a consistent problem (very much including an internet slowdown), I start by assuming that the problem is on my end. Once I have eliminated that possibility, only then do I progress to other possible causes.

Thanatos

naporeon wrote: »

Then my suggestion would be to incorporate process analysis into your security routine. Familiarize yourself with HijackThis (or a similar tool), and monitor your processes on occasion, to prevent this sort of problem from reoccurring. Antispyware and antivirus programs are only part of a vigilant security routine; familiarity with your system should be your first line of defense.

Immediately assuming that a service interruption or slowdown is the responsibility of your ISP--instead of paying closer attention to your machine--is a recipe for disaster.

And as far as your points go:
1. Regular scans - Useful, but not infallible. Familiarity with system processes is arguably more important.
2. Firewall - Completely irrelevant in this case. A firewall stops or throttles traffic. It does not stop the downloading or installation of malicious software on your PC.
3. System behavior - Your perspective may of course differ from my own, but when I notice a consistent problem (very much including an internet slowdown), I start by assuming that the problem is on my end. Once I have eliminated that possibility, only then do I progress to other possible causes.

I keep pretty careful track of my machine, and things that change in it. However, when the change exactly corresponds to a move, my roommate is having the same problems, and we continue having them after switching routers, I tend to think that the problem isn't malware.

The only thing Kaspersky found was that adware program from the HijackThis! log. Any further suggestions for scans, or is it safe to say that this house is clean?