PC freeze when connected to internet

[Guest]

I upgraded to a broadband connection a few days ago. I connect to the
internet via a dial up process without problems and for approximately 5
minutes my connection is perfect. But, suddenly.....complete freeze! No
error messages, just a complete freeze. I power down and reboot and off we go
again. No other problems apparent on any other process and prior to broadband
installation I connected via standard modem and ran without problems. This is
not an intermittent fault....it occurs every time I connect and the time
scale appears to be the same every time. Please could anybody advise.

 

[Malke]

I upgraded to a broadband connection a few days ago. I connect to the
internet via a dial up process without problems and for approximately
5
minutes my connection is perfect. But, suddenly.....complete freeze!
No error messages, just a complete freeze. I power down and reboot and
off we go again. No other problems apparent on any other process and
prior to broadband installation I connected via standard modem and ran
without problems. This is not an intermittent fault....it occurs every
time I connect and the time scale appears to be the same every time.
Please could anybody advise.

You will need to determine what is happening at that time. Look in Event
Viewer (Start>Run eventvwr.msc [enter]) for clues. See what is failing.
Unfortunately, we don't have a lot of information to go on here in
order to narrow down the troubleshooting. Other things to check are
whether your computer is 100% malware-free. If you need help with that,
post back. There might also be a hardware issue with your NIC. Start
with Event Viewer and let us know what it says.

Malke

 

[Chuck]

I upgraded to a broadband connection a few days ago. I connect to the
internet via a dial up process without problems and for approximately 5
minutes my connection is perfect. But, suddenly.....complete freeze! No
error messages, just a complete freeze. I power down and reboot and off we go
again. No other problems apparent on any other process and prior to broadband
installation I connected via standard modem and ran without problems. This is
not an intermittent fault....it occurs every time I connect and the time
scale appears to be the same every time. Please could anybody advise.

Phil,

Do you have a NAT router connecting your computer to the broadband modem? If
not, get one. For everybody's sake.

How current is your virus protection? Try one or more of these free online
virus scans, which should complement your current protection:
<http://www.bitdefender.com/scan/license.php>
<http://www.pandasoftware.com/activescan>
<http://www.ravantivirus.com/scan/>
<http://security.symantec.com/ssc/home.asp>
<http://housecall.trendmicro.com/housecall/start_corp.asp>

Now check for, and learn to defend against, non-viral malware. Have you
downloaded these programs before? Download them again, as the latest version
may be needed to keep up with the current level of malware being attempted
constantly - get the absolutely most current version of each product listed.
They're all free - and most pretty small, so they download quickly enough.

Start by downloading each of the following additional free tools - and download
each individual product from each link as listed:
AdAware <http://www.lavasoftusa.com/>
CWShredder <http://www.majorgeeks.com/download4086.html>
HijackThis <http://www.tomcoyote.com/hjt/>
LSP-Fix <http://www.cexx.org/lspfix.htm>
WinsockXPFix <http://www.spychecker.com/program/winsockxpfix.html>
Spybot S&D <http://www.safer-networking.org/index.php?page=download>
Stinger <http://us.mcafee.com/virusInfo/default.asp?id=stinger>

Create a separate folder for HijackThis, such as C:\HijackThis - copy the
downloaded file there. AdAware, CWShredder, and Spybot S&D have install
routines - run them. The other downloaded programs can be copied into, and run
from, any convenient folder.

First, close all Internet Explorer and Outlook windows.

Run Stinger. Have it remove all problems found.

Run CWShredder. Have it fix all problems found.

Next, run AdAware. First update it, configure for full scan
(<http://forums.spywareinfo.com/index.php?showtopic=11150>), then scan. When
scanning finishes, remove all Critical Objects found.

Next, run Spybot S&D. First update it, then run a scan. Trust Spybot, and
delete everything ("Fix Problems") that is displayed in Red.

Then, run HijackThis ("Scan"). Do NOT make any changes immediately. Save the
HJT Log.
<http://forums.spywareinfo.com/index.php?showtopic=227>

Finally, have your HJT log interpreted by experts at one or more of the
following security forums (and please post a link to your forum posts, here):
Aumha: <http://forum.aumha.org/index.php>
Net-Integration: <http://forums.net-integration.net/>
Spyware Info: <http://forums.spywareinfo.com/>
Spyware Warrior: <http://spywarewarrior.com/index.php>
Tom Coyote: <http://forums.tomcoyote.org/>

If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.

Finally, improve your chances for the future.

Harden your browser. There are various websites which will check for
vulnerabilities, here are three which I use.
http://www.jasons-toolbox.com/BrowserSecurity/
http://bcheck.scanit.be/bcheck/
https://testzone.secunia.com/browser_checker/

Consider using an alternative browser, like Firefox, for the majority of your
browsing activities.
<http://www.spreadfirefox.com/?q=affiliates&id=4507&t=61>

Block Internet Explorer ActiveX scripting from dangerous websites (Restricted
Zone).
<https://netfiles.uiuc.edu/ehowes/www/main.htm> (IE-SpyAd)

Block known dangerous scripts from running.
<http://www.javacoolsoftware.com/spywareblaster.html>

Block known spyware from installing.
<http://www.javacoolsoftware.com/spywareguard.html>

Make sure that the spyware detection / protection products that you use are
reliable:
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Harden your operating system. Check at least monthly for security updates.
http://windowsupdate.microsoft.com/

Block possibly dangerous websites with a Hosts file. Three Hosts file sources I
use:
http://www.accs-net.com/hosts/get_hosts.html
http://www.mvps.org/winhelp2002/hosts.htm
(The third is included, and updated, with Spybot (see above)).

Maintain your Hosts file (merge / eliminate duplicate entries) with:
eDexter <http://www.accs-net.com/hosts/get_hosts.html>
Hostess <http://accs-net.com/hostess/>

Secure your operating system, and applications. Don't use, or leave activated,
any accounts with names or passwords with trivial (guessable) values. Don't use
an account with administrative authority, except when you're intentionally doing
administrative tasks.

Use common sense. Yours. Don't install software based upon advice from unknown
sources. Don't install free software, without researching it carefully. Don't
open email unless you know who it's from, and how and why it was sent.

Educate yourself. Know what the risks are. Stay informed. Read Usenet, and
various web pages that discuss security problems. Check the logs from the
security products that you use regularly, look for things that don't belong, and
take action when necessary.

How did I get infected in the first place?
http://forums.net-integration.net/index.php?showtopic=3051
Essential tips for infection prevention
http://forums.spywareinfo.com/index.php?showtopic=24339
http://www1.spywareinfo.com/articles/hijacked/prevent.php

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.

 

[Guest]

Chuck.............what a comprehensive response ! Thanks to both Malke and
yourself...you're gents !

Right, in more detail this my setup.....Presuming a NAT router means a
network address translator, then yes, I have one. I connect to it via
ethernet cable. My system is firewalled and protected with Nortons Internet
Security and Anti-virus and I run Spybot S & D, CW Shredder, SpyBlaster &
Active Ports on a regular basis. My system is fully up to date with SP2, as
are my virus definitions, Spybot updates, etc. I'm proud to say I'm paranoid
about security but aren't we all ! There's probably more I can do but by the
time I've finished going through all your suggestions (and I will) I'll feel
even better about it.

I'm reasonably (?) sure I'm not subject to malware, etc, on this occassion
but have to admit to being totally stumped with this problem. I presume from
the responses that the freezing problem and it's timing is highly indicative
of some form of spyware/malware problem. IF it isnt.....any idea where else
to start looking for answers?

Really appeciate the time you've both taken to respond and advise so far.
Cheers
Phil

 

[Chuck]

Chuck.............what a comprehensive response ! Thanks to both Malke and
yourself...you're gents !

Right, in more detail this my setup.....Presuming a NAT router means a
network address translator, then yes, I have one. I connect to it via
ethernet cable. My system is firewalled and protected with Nortons Internet
Security and Anti-virus and I run Spybot S & D, CW Shredder, SpyBlaster &
Active Ports on a regular basis. My system is fully up to date with SP2, as
are my virus definitions, Spybot updates, etc. I'm proud to say I'm paranoid
about security but aren't we all ! There's probably more I can do but by the
time I've finished going through all your suggestions (and I will) I'll feel
even better about it.

I'm reasonably (?) sure I'm not subject to malware, etc, on this occassion
but have to admit to being totally stumped with this problem. I presume from
the responses that the freezing problem and it's timing is highly indicative
of some form of spyware/malware problem. IF it isnt.....any idea where else
to start looking for answers?

Really appeciate the time you've both taken to respond and advise so far.
Cheers
Phil

Phil,

Thanks for the feedback. Even though Malke's not a gent, I'm sure she
appreciates it too.

If you don't have a malware problem (and from your latest description that's
less likely, than from your original problem report), you might want to see
what's happening when the computer freezes.

Get Process Explorer (free) from
<http://www.sysinternals.com/ntw2k/freeware/procexp.shtml>. Provides way more
information than Task Manager.
And Port Explorer (free) from
<http://www.diamondcs.com.au/portexplorer/index.php?page=home> will show you
what network connections your computer is actually opening, and what processes
are opening them. Also, Autoruns (also free, and also from SysInternals)
<http://www.sysinternals.com/ntw2k/freeware/autoruns.shtml> will show you
specifically what process are started automatically.

Do you by any chance use a Hosts based website blocker?

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.

 

[Alexander Sverdlov]

Chuck.............what a comprehensive response ! Thanks to both Malke and
yourself...you're gents !

Right, in more detail this my setup.....Presuming a NAT router means a
network address translator, then yes, I have one. I connect to it via
ethernet cable. My system is firewalled and protected with Nortons Internet
Security and Anti-virus and I run Spybot S & D, CW Shredder, SpyBlaster &
Active Ports on a regular basis. My system is fully up to date with SP2, as
are my virus definitions, Spybot updates, etc. I'm proud to say I'm paranoid
about security but aren't we all ! There's probably more I can do but by the
time I've finished going through all your suggestions (and I will) I'll feel
even better about it.

I'm reasonably (?) sure I'm not subject to malware, etc, on this occassion
but have to admit to being totally stumped with this problem. I presume from
the responses that the freezing problem and it's timing is highly indicative
of some form of spyware/malware problem. IF it isnt.....any idea where else
to start looking for answers?

Really appeciate the time you've both taken to respond and advise so far.
Cheers
Phil

:

Why don't him just use EventLog???
go to run, then - mmc, then - file - add/remove snap in, and Event
viewer... Then you'll see the problem, I guess.

 

[Guest]

Chuck,
Thanks again for download suggestions......if less than 5 mins to download
(freeze time) I'll get them installed and see what they can tell me.
Guess I owe Malke an apology ! (.)(.) Get your act together Phil !
Just one nerdy question: How do I tell if I'm using a Hosts based website
blocker?
Cheers
Phil

 

[Chuck]

Chuck,
Thanks again for download suggestions......if less than 5 mins to download
(freeze time) I'll get them installed and see what they can tell me.
Guess I owe Malke an apology ! (.)(.) Get your act together Phil !
Just one nerdy question: How do I tell if I'm using a Hosts based website
blocker?
Cheers
Phil

Phil,

If your Hosts file (which should be in C:\WINDOWS\system32\drivers\etc) has
anything more than a single entry:
127.0.0.1 localhost
Then you may be blocking websites that are listed in there. If your Hosts file
is large, your system will grind to a halt when it loads the file, unless you
disable the DNS Client service.
http://www.mvps.org/winhelp2002/hosts.htm
http://www.hosts-file.net/downloads.html

You should be able to download most of those programs in a couple minutes if
your broadband is any decent speed. If you keep running into problems, boot the
system into Safe Mode With Networking, and download.
http://support.microsoft.com/?id=315222

If you keep running into problems, boot into Safe Mode, and run HijackThis.
Then get expert advice for log interpretation. Better to be paranoid than
oblivious.

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.