Help Needed Desperatley!!!!

My sister has just got broadband, she has a pc with P3 600mhz 256mb ram,
when she connects to broadband it downloads ALL the time and she can't get
onto any websites?? She is using Norton AV and Zonealrm.

Can anyone advise on how I can find out what it is downloading and any other
advice. She had no problems on Dial-up and they have been unable to use the
broadband since installation. Its a Win XP system.

ANY advice would be helpful.

TIA

"Melmac" <melmacr(REMOVE)@(THIS)gmail.com> wrote in
news:4274a493$0$30715$(E-Mail Removed) ng.com:

> Can anyone advise on how I can find out what it is downloading and any
> other advice. She had no problems on Dial-up and they have been unable
> to use the broadband since installation. Its a Win XP system.

Sounds like spyware/trojan.

Get Adaware, Spybot, HiJackThis (requires technical knowledge to use) and
MS AntiSpyware. Install them and all their updates then boot into safe
mode and run them all as many times as needed until they stop picking
things up. If they don't stop picking things up then you need to get it
cleaned properly.

Easiest solution is to format and reinstall Windows and restore data from
backups.

--
Colin
*Drop DEAD from the email address to reply*

whilst i am sure 256mb is adequate for your sister most people do use 512mb
and even more in some cases.
"cw" <(E-Mail Removed)> wrote in message
news:Xns9649717D0C580cwfidei@212.159.2.87...
> "Melmac" <melmacr(REMOVE)@(THIS)gmail.com> wrote in
> news:4274a493$0$30715$(E-Mail Removed) ng.com:
>
>> Can anyone advise on how I can find out what it is downloading and any
>> other advice. She had no problems on Dial-up and they have been unable
>> to use the broadband since installation. Its a Win XP system.
>
> Sounds like spyware/trojan.
>
> Get Adaware, Spybot, HiJackThis (requires technical knowledge to use) and
> MS AntiSpyware. Install them and all their updates then boot into safe
> mode and run them all as many times as needed until they stop picking
> things up. If they don't stop picking things up then you need to get it
> cleaned properly.
>
> Easiest solution is to format and reinstall Windows and restore data from
> backups.
>
> --
> Colin
> *Drop DEAD from the email address to reply*

I have run all these but not in safe mode, does that make a big difference
to run them in safe mode??

"cw" <(E-Mail Removed)> wrote in message
news:Xns9649717D0C580cwfidei@212.159.2.87...
> "Melmac" <melmacr(REMOVE)@(THIS)gmail.com> wrote in
> news:4274a493$0$30715$(E-Mail Removed) ng.com:
>
>> Can anyone advise on how I can find out what it is downloading and any
>> other advice. She had no problems on Dial-up and they have been unable
>> to use the broadband since installation. Its a Win XP system.
>
> Sounds like spyware/trojan.
>
> Get Adaware, Spybot, HiJackThis (requires technical knowledge to use) and
> MS AntiSpyware. Install them and all their updates then boot into safe
> mode and run them all as many times as needed until they stop picking
> things up. If they don't stop picking things up then you need to get it
> cleaned properly.
>
> Easiest solution is to format and reinstall Windows and restore data from
> backups.
>
> --
> Colin
> *Drop DEAD from the email address to reply*

> My sister has just got broadband <snip>
> Can anyone advise on how I can find out what it is downloading and any other
> advice. She had no problems on Dial-up and they have been unable to use the
> broadband since installation. Its a Win XP system.
> ANY advice would be helpful.

I`ve got links to anti-spyware stuff that I try to keep updated online
here:

http://www.coreutilities.co.uk

Every file I link to is free with the exception of Pest Patrol - I have
no affiliation with them, I was just impressed with the results of a scan
I saw on someones' machine. It can list what I would describe as false
positives (such as VNC) but it does a good job of finding orphan files
from apps like Kazaa.

Other thoughts...

Was she up to date with her XP updates ?
What does ZA show as accessing the net ?
Why does anyone use Norton these days ? (it sucks as a virus checker)

--
Please add "[newsgroup]" in the subject of any personal replies via email
--- My new email address has "ngspamtrap" & @btinternet.com in it ;-) ---

"Melmac" <melmacr(REMOVE)@(THIS)gmail.com> wrote in message
news:4274a493$0$30715$(E-Mail Removed) ng.com...
> My sister has just got broadband, she has a pc with P3 600mhz 256mb ram,
> when she connects to broadband it downloads ALL the time and she can't get
> onto any websites?? She is using Norton AV and Zonealrm.
>
> Can anyone advise on how I can find out what it is downloading and any
> other advice. She had no problems on Dial-up and they have been unable to
> use the broadband since installation. Its a Win XP system.
>
> ANY advice would be helpful.

Contrary to what others think I am inclined to think this is not spyware
related as the problem occurred immediately when switching to the broadband.
Did your sister do a direct upgrade from her dialup account to a broadband
account? Or are the accounts different?
Have you tried disabling Zonealarm to see if the connection works?
Has her broadband line actually been activated?
Have you been onto broadband support line to find out if they have problems
in the area?
Maybe her installation has failed at the exchange. Maybe the modem is not
installed correctly.
Do the lights on the modem light up or flash in accordance with what it
states in the manual for that modem?
Has your sister attached a microfilter to all telephony devices which are on
that phone line?
Does she have a Sky digibox? These have been known to interfere with
broadband. Try unplugging the sky box and see if the connection works.
Go into Internet explorer (if that is the browser) and go to tools, internet
options. Click on the connections tab - is there a dot in "never dial a
connection"? If so, change that to one of the other options and see if it
can pick up the connection. What modem does it say in the box above? Does
it say the adsl modem?
There are so many things it could be that its difficult to know where to
start really..

On Sun, 01 May 2005 10:16:36 GMT, "Stefan Kaniuk" <(E-Mail Removed)>
wrote:

>whilst i am sure 256mb is adequate for your sister most people do use 512mb
>and even more in some cases.
>"cw" <(E-Mail Removed)> wrote in message
>news:Xns9649717D0C580cwfidei@212.159.2.87...
>> "Melmac" <melmacr(REMOVE)@(THIS)gmail.com> wrote in
>> news:4274a493$0$30715$(E-Mail Removed) ng.com:
>>
>>> Can anyone advise on how I can find out what it is downloading and any
>>> other advice. She had no problems on Dial-up and they have been unable
>>> to use the broadband since installation. Its a Win XP system.
>>
>> Sounds like spyware/trojan.
>>
>> Get Adaware, Spybot, HiJackThis (requires technical knowledge to use) and
>> MS AntiSpyware. Install them and all their updates then boot into safe
>> mode and run them all as many times as needed until they stop picking
>> things up. If they don't stop picking things up then you need to get it
>> cleaned properly.
>>
>> Easiest solution is to format and reinstall Windows and restore data from
>> backups.
>>
>> --
>> Colin
>> *Drop DEAD from the email address to reply*
>

With Broadband your machine can be remotely analyzed more quickly than on
those occasions when you are connected by dial up. The possibility exists
that the diagnostics have indicated that your PC requires some serious
updating which means that many megabytes are winging your way from Bill Gates,

While all this is going on it is difficult to see how you could download the
programs that have been suggested. I think a good bet would be to get someone
else to download the programs, copy these to a memory stick and use that to
get the programs into your PC. Run these programs before reconnecting to the
Internet. Personally I have found SpySubtract to be an excellent product and
one that should be applied first.

This problem won't go away if you decide to format the hard disk for a clean
start and in fact could mean you spending days at your PC rebuilding it if you
went down that route. Lack of originally supplied installation disk will make
the task very difficult and there is actually a correct sequence that they
should be loaded to give a hassle free rebuild. I can not agree that this
represents the "easiest solution". When you apply the backups of your
personal data you might reintroduce the original problem!

David Bradley

David Bradley <(E-Mail Removed)> wrote in
news(E-Mail Removed):

> This problem won't go away if you decide to format the hard disk for a
> clean start and in fact could mean you spending days at your PC
> rebuilding it if you went down that route. Lack of originally supplied
> installation disk will make the task very difficult and there is
> actually a correct sequence that they should be loaded to give a
> hassle free rebuild. I can not agree that this represents the "easiest
> solution". When you apply the backups of your personal data you might
> reintroduce the original problem!

Well seen as we do this repeatedly at our workplace on customer machines,
there are a few points I would raise

1) Automatic updates puts an icon in the corner and flashes up messages
in most standard configurations

2) Spyware and trojans get themselves in many places but I have yet to
come across any 'in the wild' that hide themselves in customer data.
Still we scan everything before putting it back on and leave a resident
sheild in place.

You can spend hours and hours running and rerunning these applications
but they will only remove what they know about. There is no guarentee
that they will get rid of everything.

Standard security practice by networking professionals when any machine
is compromised is to take it offline. Any decent specialist will not put
a compromised server back into play without a complete rebuild to ensure
it is safe, why should a PC be treated any different.

On average, a clean windows build can be back up and running within an
hour.

Your choice.

--
Colin
*Drop DEAD from the email address to reply*

"Melmac" <melmacr(REMOVE)@(THIS)gmail.com> wrote in
news:4274b69d$0$30238$(E-Mail Removed) ng.com:

> I have run all these but not in safe mode, does that make a big
> difference to run them in safe mode??

Very much so, if the machine is not running in safe mode the malware will
be running in the background. This will give it an opportunity to hide
itself, prevent the software from detecting/removing it or simply
reintroduce itself when removed.

Safe mode prevent most malware from loading. There are one or two that
find their way in but in general safe mode is much better for cleaning
than normal mode.

--
Colin
*Drop DEAD from the email address to reply*

"Beck" <(E-Mail Removed)> wrote in
news:(E-Mail Removed):

> Contrary to what others think I am inclined to think this is not
> spyware related as the problem occurred immediately when switching to
> the broadband.
>

I said spyware/trojans.

There are plenty of cases where the PC is infected with a backdoor that
hooks up to an IRC server. It can immediately take part in spam
distribution, DoS attacks or be part of a warez botnet and hence be
sucking up the bandwidth almost instantaneously.

I once installed BT broadband for someone before putting the firewall on
(slip of the memory..) and within a couple of minutes there was a trojan
downloading some files to be used in a warez botnet. I couldn't do
anything else with the net connection until the firewall went on and
blocked the trojan.

That one was a pain as well because nothing recognised it and I had to
clear it manually :0/

Still all the other things are worth considering, I'm just saying that it
happening straight away does not mean that it isn't malware.

--
Colin
*Drop DEAD from the email address to reply*