Drastic reduction in Internet speed for Windows laptop--help!

[Aeschines]

We have broadband at home with ethernet jacks in every room. Here is a key fact:

My Mac laptop is running fine.

But yesterday evening, my wife's Windows XP/Fujitsu laptop started running at about 1/5 normal speed:

1. Spybot is installed and all spyware removed (we did this several days ago, actually, and there was not much there).

2. Did virus check on Symantec's page--nada.

3. Everything else seems fine.

4. Pages load really slow. Usually the words comes up first, with pics taking a long time to load.

Any ideas? I would be inclined to blame the broadband provider were it not for the fact that my Mac is running mostly OK (I have been getting lots of "Safari can't find server" messages that require an extra try, but when pages load they are quite fast.)

Thanks much for your help.

[ookpik]

You may still have spy, ad or malware installed.

You need to scan often, and with more than one scanner sometimes.
(different vendors products, not multiple instances at once)

Check your internet options settings:
Connections - LAN settings
Make sure you're not:

Auto detecting settings
No proxy
No auto config

Open a DOS window:
type IPCONFIG, your default gateway should be a different IP than your PC
If it isn't, somthing has changed it and is redirecting you when you try to surf.

[ookpik]

Use Firefox instead of IE...

[Aeschines]

Thanks for your help.

I looked at the LAN settings. It was on auto-detect, but I think I put that on myself when trying to get the laptop to work on the system here. I turned it off.

I then did the DOS shell thing, getting this:

Connection-specific DNS suffix: [blank]
IP address: 192 etc.
Subnet mask: 255 etc.
Default gateway: 192 etc.

With the two 192 etc.'s being the same.

Does that sound right?

I noticed also that going from page to page takes a very long time, but a search in Google is still lightning fast.

[Aeschines]

Wait a sec:

I DON'T want autodetect.

But I DO want proxy and autoconfig.

----

What I DID have was autodetect WITHOUT proxy and autoconfig.

----

Is that bad?

[Aeschines]

I actually just installed Firefox. It's still slow in exactly the same way:

The page loads (rather slowly) without the graphics, and then the graphics creep in.

Very frustrating.

[LordVor]

IP address: 192 etc.
Subnet mask: 255 etc.
Default gateway: 192 etc.

With the two 192 etc.'s being the same.

Does that sound right?


No. The gateway should be the address of the router in between you and the internet. You've got this statically configured, or is this what DHCP did to you?

-lv

[Daizy]

Hi Aeschines
How much Ram is installed on that XP Machine?
What all do you have running in the background?
(Go to start...then run...then type in msconfig .... click ok...then look under the start up tab.)
List for us what you have checked.

When you did your spyware check...did you check for any updates first?

[ookpik]

Check with your ISP for the default gw IP.

Basically, if a destination cannot be found locally, the DG is where it will go.

So this should be a device other than your laptop.

Try connecting without any of those selections in Intenet Options, see what happens.

You may need the proxy setting and autoconfig, with my ISP I don't...this can vary though.

But the GW having the same IP as the PC is definitely a problem and one I see every now and then on my system.

I'll bet dolllars to donuts that if you look at your HOSTS file you'll see a whole whack of entries that should not be there.

Let me know if this is the case

[Aeschines]

Hi Aeschines
How much Ram is installed on that XP Machine?
What all do you have running in the background?
(Go to start...then run...then type in msconfig .... click ok...then look under the start up tab.)
List for us what you have checked.

When you did your spyware check...did you check for any updates first?

Yes, I checked for updates first. Here is what I found under the setup tab:

IMJMIG
TINTSETUP
TINTSETUP
hkcmd
AGRSMMSG
Apoint
Indicator Uty
QuickTouch
BtnHnd
PUSCDaemon
ezSP_Px
IMJPMIG
iNetConDsp
FMVLauncherKicker
jusched
updatenv
usnpstd2
ctfmon
msmsgs
YPagerJ
Fujitsu Service Assistant

A lot of this is Fujitsu stuff in the Fujitsu folder, but, for example, I have no idea what "Apoint" is, which was in the Apoint folder/directory.

[Daizy]

Not to disagree with ookpik2, but the default gateway should be the default address of your router. You will have to look up your router setup to determine the IP address of the router.

As for the autoconfig and proxy settings, it's most likely you don't need them.

The hosts file, btw, is here: C:\WINDOWS\SYSTEM32\DRIVERS\ETC

in some rare cases it's been reported that a large HOSTS file tends to slow down the machine. This usually only happens in W2, but may occur in XP.
To resolve this issue open the "Services Editor"

Start | Run (type) "services.msc" (no quotes)
Scroll down to "DNS Client", Right-click and select: Properties
Click the drop-down arrow for "Startup type"
Select: Manual, click Apply\Ok and restart. [more info]
You can see that the above "Service" is not needed (after a little browsing) by opening the Services Editor again, scroll down to DNS Client and check the "Status" column. It should be blank, if it was needed it would show "Started" in that column.




From here. (http://www.mvps.org/winhelp2002/hosts.htm)

[Aeschines]

Check with your ISP for the default gw IP.

Basically, if a destination cannot be found locally, the DG is where it will go.

So this should be a device other than your laptop.

Sorry, I was wrong. I just looked again. The last three digits are different for the IP address and the DF. Then I looked at my Mac config. The router (Mac) is the same as the DF (PC).

So maybe that's OK? They are almost the same number; just the endings are different.
I'll bet dolllars to donuts that if you look at your HOSTS file you'll see a whole whack of entries that should not be there.

Let me know if this is the case
I tried to do a search on HOSTS but all I got was sample files. Could it be that there are none? How should I look?

Thanks thus far for everyone's help.

[ookpik]

Daizy: You're not disagreeing:

"So this should be a device other than your laptop."

[Daizy]

IMJMIG (You can uncheck)
TINTSETUP (You can uncheck)
TINTSETUP (You can uncheck)
hkcmd
AGRSMMSG
Apoint
Indicator Uty
QuickTouch
BtnHnd
PUSCDaemon
ezSP_Px
IMJPMIG (You can uncheck)
iNetConDsp
FMVLauncherKicker
jusched (You can uncheck)
updatenv
usnpstd2
ctfmon
msmsgs (You can uncheck)
YPagerJ (You can uncheck)
Fujitsu Service Assistant


It's a start.
Click apply...then ok.... then reboot.
When the nag screen about selective start up shows up...tell it to not show you again

[ookpik]

Ok so the DG is correctly set then.

As long as the IP address is not the same as that of the PC.

You searched for HOSTS*.* and the only one it found was hosts.sam?

If you find one with no extension open it with notepad and see what's in there.

Other than that, you might want to eliminate the cabling in your house as the problem.

Try connecting directly to the DSL modem with that notepad

Try deleting cookies
All offline content etc...

[Daizy]

I tried to do a search on HOSTS but all I got was sample files. Could it be that there are none? How should I look?

Thanks thus far for everyone's help.


You should find it here:
C:\WINDOWS\SYSTEM32\DRIVERS\ETC

[Daizy]

You've still not said how much ram you are running?
Have you cleaned out your temp files and done a scandisk and defrag lately?

[LordVor]

Sorry, I was wrong. I just looked again. The last three digits are different for the IP address and the DF. Then I looked at my Mac config. The router (Mac) is the same as the DF (PC).

The router (gateway) and netmask should be the same on both the mac and the pc, and the ip addresses should be different. The bits that are different in the ip addresses should be 0s in the netmask. (IOW, if you're netmask ix 255.255.255.0, then the only difference in the ip addresses should be after the last period).

-lv

[LordVor]

You've still not said how much ram you are running?


Read the OP. I doubt that he suddenly decided to take memory out of the laptop last night.

-lv

[Freejooky]

Read the OP. I doubt that he suddenly decided to take memory out of the laptop last night.


There is no mention of RAM in the OP - at all.

[Daizy]

Read the OP. I doubt that he suddenly decided to take memory out of the laptop last night.

-lv

Oh, I'm sure you didn't mean that as rudely as it sounded....so I'll just let that one slip by....

It's a legitimate question. If the ram that is running in that machine is low, he may well have added programs lately that are now running on start up and further using up resources.

Yes, resources and ram are two different things...but little has been said about what the exact system specs are.

[Aeschines]

Not to disagree with ookpik2, but the default gateway should be the default address of your router. You will have to look up your router setup to determine the IP address of the router.

As for the autoconfig and proxy settings, it's most likely you don't need them.

The hosts file, btw, is here: C:\WINDOWS\SYSTEM32\DRIVERS\ETC



From here. (http://www.mvps.org/winhelp2002/hosts.htm)

I did this, to no effect....

[Aeschines]

OK, I'm trying everything but nothing's working.

Let's review the facts of the case and the current symptoms:

1. The machine suddenly got slow yesterday. I did so without a restart; it was totally out of the blue.

2. Web pages load slow, graphics extremely slow, and some ads are getting timeouts on Firefox.

3. On the other hand, a search within Google is lightning fast.

4. Also, MS Messenger chat is working as normally.

5. I did a bandwidth test on both machines. The Mac came up 1.7M, while the PC was 1.6. May I conclude from this that the Internet connection itself cannot be to blame?

Very frustrating. Thanks for your continued help!

[Aeschines]

Also, machine RAM should be very good. We only got the laptop a few months ago. It's a fairly high-end Fujitsu. We are not running any unusual programs, either, other than, perhaps, Yahoo Messenger.

[Daizy]

If this was something sudden...then have you tried simply using a sytem restore point to a time before this happened?

[Daizy]

Also, machine RAM should be very good. We only got the laptop a few months ago. It's a fairly high-end Fujitsu. We are not running any unusual programs, either, other than, perhaps, Yahoo Messenger.

Do you know what these are?

PUSCDaemon
iNetConDsp
FMVLauncherKicker
updatenv
usnpstd2

Have you unchecked the ones I've already mentioned?

[Aeschines]

My wife now says that a smiley message popped up while she was chatting with her mom she started the download process but didn't finish it.

Just now, even though I was not on yahoo.co.jp (the Japan Yahoo), at the bar at the bottom of IE, it said it was dowloading something.

I looked at the host files again, and some came up. Being ignorant, I don't know what is good or bad. But one was "RCDHOST." I opened up the file, and it was full of garbage characters.

Man, is this as bad as it sounds? How can I fix this?

[Aeschines]

Did a system restore to last Sunday, when there were no problems at all.

NO CHANGE.

In fact, now the Internet on the machine is running disastrously slow, with chunks of pages not loading at all, etc.

But it IS connected, as I got www.myway.com and looked at the sports page (which my wife would not have cached), and it loaded current content.

WTF?!

[ookpik]

Couple of things:

Spyware, Adware and all of their variants are pretty sophisticated little nuisances, and that's putting it mildly.

These intruders are capable of installing themselves in such a way as to detect when they've been found, rename their processes and re-install themselves.

For some more info on this, check out CNN.com click on the Technology link and search for Adware or Lavasoft or Spy Sweeper. The articles are from last week or the week before and are quite informative.

The fact that you're running XP rather than 98 makes a huge difference.

I volunteer at the retirement residence where my wife works as a PC resource for them in order to prevent some of the flagrant abuse these folks can be subjected to by unscrupulous individuals.

You would not believe the shape of some of these 98 running machines once they've been subjected to Spy/Ad/Malware etc...

XP is somewhat more robust at least.

As I mentioned earlier though, its always a good idea to make the environment as simple as possible.

Take your network out of the picture completely and connect the laptop directly into your DSL modem.

See if your response times improve.

If there is a significant improvement, you may have a cabling problem.

Assuming they don't, download and install AdAware from Lavasoft and Spy Sweeper from Webroot.

Adaware has a free version for personal use which is limited to on demand system scans; i.e. it doesn't catch problems on-the-fly.

Spy Sweeper works in real time, but requires purchase/registration. For the time-being though, you can install their trial version which is good for 30 days.

Between these 2 applcations, you should be able to clean up the machine fairly well.

Unfortunately, unlike diamonds, this ain't forever. These problems will re-occur.

Those articles on CNN have some good asvice: namely, be careful where you go on the Interweb...Anything offered to download for "FREE" should be carefully considered. In many cases, this is just a delivery method for problems such as those you're seeing.

To Daizy: Bonus points for you my Frozen North colleague if you can tell me from where I got the term Interweb.

Kind Regards,

Steve

[HMS Irruncible]

There is a piece of malware going around that will install a firewall and other security features in your system automatically without your knowledge, sometimes resulting in disastrous system slowdowns.

The malware is called "Windows Update" and the payload is "Windows XP Service Pack 2." You can see if you are infected by right-clicking on "my computer" and selecting "properties." It should show you some information about your computer including the OS version and service pack level.

You might be double-firewalled at this point, which would slow things down considerably. One fix you could try is to go to start/settings/control panel and follow the iconic prompts to shut off the firewall. Another might be to completely uninstall SP2.

[Cillasi]

Is this laptop farther away from the router than the other machines? Try moving it to a jack you know is working properly. If the problem clears up, either the jack is faulty or it is just too far from the source. To figure out which one it is, just connect the working laptop to the suspect jack.

[Aeschines]

Is this laptop farther away from the router than the other machines? Try moving it to a jack you know is working properly. If the problem clears up, either the jack is faulty or it is just too far from the source. To figure out which one it is, just connect the working laptop to the suspect jack.
Just tried it on the jack where the Mac is doing fine. Same deal.

Someone mentioned plugging it directly into the DSL modem. That is located high in the top of a closet, so it is a little inconvenient. My intuition tells me it's not going to make a difference, but I could be wrong. After all, keep in mind that the Mac is running fine. That leads me to believe that it's a problem within the laptop box.

Does all this really seem like a malware effect? I find the particular way (pages and graphics load slow, but bandwidth measures high and chat speeds are normal) and timing (quite sudden with no great changes + sys-restore doesn't work) very curious. Could it actually be a hardware or some other similar problem, so that the system is now choking on the graphics it is trying to download from web pages?

Or could it be some problem with the broadband service itself that affects Windows but not Mac?

I'll tell you one thing, though, with the debacle that XP is (service pack 2, my ass), I'll never buy a Windows box again if I can help it. And I say this even after having a motherboard failure on my iBook last month (covered by warranty, thankfully).

[LordVor]

It's a legitimate question. If the ram that is running in that machine is low, he may well have added programs lately that are now running on start up and further using up resources.
Fair enough. Ram just isn't the first thing I think of when something that was working suddenly starts running slowly.


5. I did a bandwidth test on both machines. The Mac came up 1.7M, while the PC was 1.6. May I conclude from this that the Internet connection itself cannot be to blame?

Yes, bandwidth is fine...which bandwidth tester did you use?

I'm going to try and step through a few debugging tools. First, right click on the taskbar (along the bottom of screen usually, in between the clock and the start button) and bring up the task manager. Click on the "processes" tab and click on the "cpu" column header twice to make the process that's using the most CPU appear at the top of the list. If any program other than the "idle" task is using more than 80% of the CPU, tell us about it. If firefox is taking all the CPU for an extraordinary amount of time when you're trying to download pages, your firefox installation may have just gone wonky, and it's time to uninstall and reinstall. Does IE show the same problems?

If that doesn't tell us anything, it's probably time to run Hijack This (http://www.tomcoyote.org/hjt/#Top) and post the log (either here or to a board more dedicated to such things).

At this point, I'd look at my router configuration and look at a few things. #1, find out what it's default gateway is (that's the first machine at the ISP that forwards all your traffic out to the rest of the world). From the dos prompt, do repeated runs of "Tracert <that ip address>". Return times should be fairly quick (although there's a chance that the router is configured to not respond at all, in which case you'd get a * instead of a number and this test won't tell us anything). If you can figure it out, it'd be useful to run the equivalent command on the Mac amd compare the results, but I don't know what that is.

The other thing I'd look at is the speed/duplex of the port that the PC is plugged into. Basically, you probably want both the router and the PC to be in "auto-negotiation mode". You can check the PC's settings by right-clicking on "My Network Places", the selecting "Properties". Right click on your network connection, and click "Properties". On the "General" tab, click the "configure" button. Each Network adapter is different at this point, but most have an "advanced" tab where you can select speed-duplex. Again, you want both ends to match, preferably at "autonegotiation".

It also may be time to break open the XP performance monitor (start->programs->administrative tools->performance). Click on the '+' sign to add counters to the moniter, choose "performance object" of "network interface", then try adding all of them and watching them for a bit, both while idle and while trying to surf.

If your outbound counters are going up significantly (many k/second) while you're not surfing, you probably have a virus that's trying to phone home or infect other machines. If the discard/error counters in either direction are going up at all, then you have a cabling problem (or the speed/duplex mismatch problem I wrote about before) and you should try other patch cables and other jacks. If your inbound counters are going up significantly while you're not surfing, then either your Mac is spamming your PC (unlikely, but does the PC have the same probelm when the Mac is off?) or the router's firewall isn't configured properly to keep unwanted out.


-lv

[LordVor]

I find the particular way (pages and graphics load slow, but bandwidth measures high and chat speeds are normal) and timing (quite sudden with no great changes + sys-restore doesn't work) very curious. Could it actually be a hardware or some other similar problem, so that the system is now choking on the graphics it is trying to download from web pages?

Remember that there's a difference between "bandwidth" and "latency". The bandwidth test blasts traffic at you as fast as it can, and you listen for a set amount of time. If the first packet it sends you takes 10 seconds to get to you (having high latency), the second packet will come immediately after that and and so on, so depending upon when your pc starts counting, it would have, say, 0 bandwidth for the first 10 seconds, then your real wire rate until the end of the test. So you end up with a high average bandwidth number.

But web sites don't work like that. It's more like this:
PC: "Hey, web site, you listening to me?"
Web site: "Yeah, I'm listening. What do you want?"
PC: "Can I have the text at <url>?"
Site: "Sure, here you go."
PC: "Thanks, can I have <picture 1> now?"
Site: "I suppose"
<repeat until all the objects on the page are loaded>

Now, if each one of those messages takes 10 seconds to get from the PC to the web site, and/or vica versa, then it'll be minutes before your web page is completely loaded. Eventually, the browser gives up and doesn't finish loading the page, because despite the fact that you have a high bandwidth, you have a high latency. This is part of the reason why I mentioned CPU usage in my previous post, if the browser isn't getting enough CPU time to send out all the requests, then the data isn't going to come back to the PC in time, and also a reason why I mentioned Tracert, as it's a latency tester.

[Aeschines]

Thanks for everyone's help. Wait! Don't go away if you have further insights--all, ALL, are appreciated.

My wife is running some tools now provided by Fujitsu--a kind of system check. Let's see the results of that; then I'll start running some of Lord V's debugs.

Thanks again.

(Frickin' Windows!)

[LordVor]

any improvement?