Sporadic network issue XP Pro

[dean]

I am having some weird network issues and I hope someone knows how to solve
this for me.

I am running windows XP Pro service pack 1 with all the Microsoft updates
applied.

My issue is this..

I have been noticing some slow traffic from this computer to a server I have
on my network.
I use the server to save my files on, transferring files has got to the
point where it can take up to 15 minutes to transfer a 10meg file
(sometimes).

I downloaded a couple of programs that diagnose issues with not much luck in
finding the problem.

I ran a part of the program that constantly pings an IP address ( in this
case my server ), it starts to ping and then times out for about 3 -20 times
then pings again another 5-50 times and does it again, it is intermittent at
times.

I thought maybe it was my network card, so I changed it out and updated the
drivers, no luck, I tried another card with the same results.

Maybe I thought its the cable, changed it out with the same results as
above.

Maybe my 10 port switch, same results, so I tried the same program with my
laptop on the server with no issues, tried the laptop on an appliance server
with no issues and tried this machine on the appliance server with the
sporadic results again, so I know its this machine that only has the issue.

Its not my cards, its not my cable or switch.

So now I think its a software issue, but I am stumped.

Can anyone help me with this issue please, its driving me crazy..

Thanks in advance.

 

[dean]

Can anyone assist me here?

Please...

 

[Chuck]

I am having some weird network issues and I hope someone knows how to solve
this for me.

I am running windows XP Pro service pack 1 with all the Microsoft updates
applied.

My issue is this..

I have been noticing some slow traffic from this computer to a server I have
on my network.
I use the server to save my files on, transferring files has got to the
point where it can take up to 15 minutes to transfer a 10meg file
(sometimes).

I downloaded a couple of programs that diagnose issues with not much luck in
finding the problem.

I ran a part of the program that constantly pings an IP address ( in this
case my server ), it starts to ping and then times out for about 3 -20 times
then pings again another 5-50 times and does it again, it is intermittent at
times.

I thought maybe it was my network card, so I changed it out and updated the
drivers, no luck, I tried another card with the same results.

Maybe I thought its the cable, changed it out with the same results as
above.

Maybe my 10 port switch, same results, so I tried the same program with my
laptop on the server with no issues, tried the laptop on an appliance server
with no issues and tried this machine on the appliance server with the
sporadic results again, so I know its this machine that only has the issue.

Its not my cards, its not my cable or switch.

So now I think its a software issue, but I am stumped.

Dean,

You've done such an intense start at diagnosing your problem, and supposedly
eliminated all of the easiest candidates. Right now, I would be thinking
malware.
<http://nitecruzr.blogspot.com/2005/05/dealing-with-malware-adware-spyware.html>
http://nitecruzr.blogspot.com/2005/05/dealing-with-malware-adware-spyware.html

When it comes time for HijackThis log interpretation, per the above, you'll be
best off in DSLR Forums Security Cleanup. There's a depth of multiple
expertises there that may be beneficial in your case. Be sure to register (it's
free) for best results.
http://www.dslreports.com/forum/cleanup

Do you have any other computer on the network that you can test with
simultaneously? Sometimes, parallel observations are useful.
<http://nitecruzr.blogspot.com/2005/08/solving-network-problems-tutorial.html>
http://nitecruzr.blogspot.com/2005/08/solving-network-problems-tutorial.html

 

[dean]

Thank you Chuck, yes I have a rather large home network and I have run 2
computers at the same time pinging the same address.
Its always the same computer that is having the issue, the one I use all the
time.

I have been looking at your blog and I am about to run one of the malware
checkers, spybot is the one I know and trust so will try that one first.

Any others you recomend? You mentioned HijackThis... will try that too.

Again thanks.

 

[Chuck]

Thank you Chuck, yes I have a rather large home network and I have run 2
computers at the same time pinging the same address.
Its always the same computer that is having the issue, the one I use all the
time.

I have been looking at your blog and I am about to run one of the malware
checkers, spybot is the one I know and trust so will try that one first.

Any others you recomend? You mentioned HijackThis... will try that too.

Again thanks.

Dean,

All malware checkers are subject to false positives (detecting some legit
software as spyware) and false negatives (not detecting some spyware), except
HijackThis. HJT is used as the referential diagnostic tool by most malware
analysts, but you will want to run the other stuff first. See the rules for the
forums (such as DSLR Security Cleanup).

If you do post on DSLR Forums, or another malware forum, please post a link to
your thread, so we can assist you better.

 

[dean]

Nothing found......... I even dropped to safe mode with networking.... SAME
problem.
It has to be a stupid M$ update that has done this, checking local loopback
is ok, pinged 127.0.0.1 is fine, pinging my local IP is fine, just anything
outbound on the adaptor is messed up.

Man this is getting enoying now, thinking about formatting and loading Suse.

Its all I seem to get is issues with Microsoft products, Issues I am unable
to repair.

Anyone have any other thoughts on this before commiting myself to Linux?

Thanks in advance.

 

[dean]

PLEASE, getting desperate now......

Nothing found......... I even dropped to safe mode with networking.... SAME
problem.
It has to be a stupid M$ update that has done this, checking local loopback
is ok, pinged 127.0.0.1 is fine, pinging my local IP is fine, just anything
outbound on the adaptor is messed up.

Man this is getting enoying now, thinking about formatting and loading Suse.

Its all I seem to get is issues with Microsoft products, Issues I am unable
to repair.

Anyone have any other thoughts on this before commiting myself to Linux?

Thanks in advance.

server

I

<http://nitecruzr.blogspot.com/2005/05/dealing-with-malware-adware-spyware.
h

http://nitecruzr.blogspot.com/2005/05/dealing-with-malware-adware-spyware.h
t

<http://nitecruzr.blogspot.com/2005/08/solving-network-problems-tutorial.ht
m

http://nitecruzr.blogspot.com/2005/08/solving-network-problems-tutorial.htm
l

all

the

Dean,

All malware checkers are subject to false positives (detecting some legit
software as spyware) and false negatives (not detecting some spyware), except
HijackThis. HJT is used as the referential diagnostic tool by most malware
analysts, but you will want to run the other stuff first. See the rules for the
forums (such as DSLR Security Cleanup).

If you do post on DSLR Forums, or another malware forum, please post a link to
your thread, so we can assist you better.

 

[Chuck]

Nothing found......... I even dropped to safe mode with networking.... SAME
problem.
It has to be a stupid M$ update that has done this, checking local loopback
is ok, pinged 127.0.0.1 is fine, pinging my local IP is fine, just anything
outbound on the adaptor is messed up.

Man this is getting enoying now, thinking about formatting and loading Suse.

Its all I seem to get is issues with Microsoft products, Issues I am unable
to repair.

Anyone have any other thoughts on this before commiting myself to Linux?

Thanks in advance.

PLEASE, getting desperate now......

Dean,

Let's back up a bit.

# Are there any other servers that you access from this computer?
# Are there any other computers accessing this server?
# Did you post in a malware forum, if so, got URL?

 

[dean]

Dean,

Let's back up a bit.

# Are there any other servers that you access from this computer?
# Are there any other computers accessing this server?
# Did you post in a malware forum, if so, got URL?

# Are there any other servers that you access from this computer? Yes, same
results.
# Are there any other computers accessing this server? Yes, but not
affected like this one.
# Did you post in a malware forum, if so, got URL? I ran SpyBot, only found
a few cookies.

I run Firefox with NoScript & AdBlock..... I did not do the HighJack this at
this time, I thought maybe seeing as SpyBot found very little I was clean,
stupid really, I know better then that.
I will run HijackThis now and posts results in the above mentioned forums
and ost a link here.

Thanks again Chuck... this is really bugging me..

 

[dean]

Ok, HJT Log posted, heres the link ....
http://www.dslreports.com/forum/remark,15407062

 

[Chuck]

Ok, HJT Log posted, heres the link ....
http://www.dslreports.com/forum/remark,15407062

OK, I'm watching the thread. You need to read their instructions thoroughly,
and repost.

 

[dean]

Chuck.... thanks for your help, but I dont have the time or patients to do
what they ask.

Its like getting blood from a stone, I closed my account on there server.

I give up, I am not going to download some 15 programs, run them twice and
fill my drive up with freeware junk.


Thanks anyway Chuck, you have been a great help.