Download and upload lights on modem constantly on

[Carbon Dudeoxide]

That didnt work. The lights are still on and the internet is still running slow. I tried doing a system restore as well but I keep getting the 'Restoration Incomplete' message.

Any other ideas?

Try doing it in Safe Mode.

[Broni]

Go Start>Run, type in:
cmd
Click OK.

At Command Prompt, type in:
NETSTAT -a -f  (<----watch for "spaces")
Hit Enter.
Copy all displayed info, and paste it in your next post.

[AndrewKelly]

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\andrew.YOUR-B04E565902.000>NETSTAT -a

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    FAMILY:http            FAMILY:0               LISTENING
  TCP    FAMILY:epmap           FAMILY:0               LISTENING
  TCP    FAMILY:microsoft-ds    FAMILY:0               LISTENING
  TCP    FAMILY:2869            FAMILY:0               LISTENING
  TCP    FAMILY:http            86-44-87-113.b-ras2.bbh.dublin.eircom.net:53728
 ESTABLISHED
  TCP    FAMILY:1484            84.53.178.24:http      TIME_WAIT
  TCP    FAMILY:1508            84.53.178.42:http      TIME_WAIT
  TCP    FAMILY:1527            jp-in-f190.google.com:http  CLOSE_WAIT
  TCP    FAMILY:1561            www.computerhope.com:http  TIME_WAIT
  TCP    FAMILY:1027            localhost:1028         ESTABLISHED
  TCP    FAMILY:1028            localhost:1027         ESTABLISHED
  TCP    FAMILY:1029            localhost:1030         ESTABLISHED
  TCP    FAMILY:1030            localhost:1029         ESTABLISHED
  TCP    FAMILY:1041            FAMILY:0               LISTENING
  TCP    FAMILY:1056            FAMILY:0               LISTENING
  TCP    FAMILY:1453            localhost:1454         ESTABLISHED
  TCP    FAMILY:1454            localhost:1453         ESTABLISHED
  TCP    FAMILY:1455            localhost:1456         ESTABLISHED
  TCP    FAMILY:1456            localhost:1455         ESTABLISHED
  TCP    FAMILY:1526            localhost:12080        ESTABLISHED
  TCP    FAMILY:12025           FAMILY:0               LISTENING
  TCP    FAMILY:12080           FAMILY:0               LISTENING
  TCP    FAMILY:12080           localhost:1526         ESTABLISHED
  TCP    FAMILY:12110           FAMILY:0               LISTENING
  TCP    FAMILY:12119           FAMILY:0               LISTENING
  TCP    FAMILY:12143           FAMILY:0               LISTENING
  TCP    FAMILY:netbios-ssn     FAMILY:0               LISTENING
  UDP    FAMILY:microsoft-ds    *:*
  UDP    FAMILY:isakmp          *:*
  UDP    FAMILY:1047            *:*
  UDP    FAMILY:1948            *:*
  UDP    FAMILY:3776            *:*
  UDP    FAMILY:4500            *:*
  UDP    FAMILY:ntp             *:*
  UDP    FAMILY:1900            *:*
  UDP    FAMILY:ntp             *:*
  UDP    FAMILY:1048            *:*
  UDP    FAMILY:1060            *:*
  UDP    FAMILY:1076            *:*
  UDP    FAMILY:1511            *:*
  UDP    FAMILY:1900            *:*
  UDP    FAMILY:domain          *:*
  UDP    FAMILY:bootps          *:*
  UDP    FAMILY:bootpc          *:*
  UDP    FAMILY:ntp             *:*
  UDP    FAMILY:netbios-ns      *:*
  UDP    FAMILY:netbios-dgm     *:*
  UDP    FAMILY:1900            *:*

C:\Documents and Settings\andrew.YOUR-B04E565902.000>

Is this what you were looking for?

Typing in NETSTAT -a -f only brought up a list of descriptions:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\andrew.YOUR-B04E565902.000>NETSTAT -a -f

Displays protocol statistics and current TCP/IP network connections.

NETSTAT [-a] [-b] [-e] [-n] [-o] [-p proto] [-r] [-s] [-v] [interval]

  -a            Displays all connections and listening ports.
  -b            Displays the executable involved in creating each connection or
                listening port. In some cases well-known executables host
                multiple independent components, and in these cases the
                sequence of components involved in creating the connection
                or listening port is displayed. In this case the executable
                name is in [] at the bottom, on top is the component it called,
                and so forth until TCP/IP was reached. Note that this option
                can be time-consuming and will fail unless you have sufficient
                permissions.
  -e            Displays Ethernet statistics. This may be combined with the -s
                option.
  -n            Displays addresses and port numbers in numerical form.
  -o            Displays the owning process ID associated with each connection.
  -p proto      Shows connections for the protocol specified by proto; proto
                may be any of: TCP, UDP, TCPv6, or UDPv6.  If used with the -s
                option to display per-protocol statistics, proto may be any of:
                IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
  -r            Displays the routing table.
  -s            Displays per-protocol statistics.  By default, statistics are
                shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6;
                the -p option may be used to specify a subset of the default.
  -v            When used in conjunction with -b, will display sequence of
                components involved in creating the connection or listening
                port for all executables.
  interval      Redisplays selected statistics, pausing interval seconds
                between each display.  Press CTRL+C to stop redisplaying
                statistics.  If omitted, netstat will print the current
                configuration information once.

C:\Documents and Settings\andrew.YOUR-B04E565902.000>

[Broni]

Try same command with -b switch.
Post results.
Who is your ISP?

[AndrewKelly]

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\andrew.YOUR-B04E565902.000>NETSTAT -b

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    FAMILY:http            86-44-87-113.b-ras2.bbh.dublin.eircom.net:53913
 ESTABLISHED     1500
  [KService.exe]

  TCP    FAMILY:1027            localhost:1028         ESTABLISHED     1500
  [KService.exe]

  TCP    FAMILY:1028            localhost:1027         ESTABLISHED     1500
  [KService.exe]

  TCP    FAMILY:1029            localhost:1030         ESTABLISHED     1500
  [KService.exe]

  TCP    FAMILY:1030            localhost:1029         ESTABLISHED     1500
  [KService.exe]

  TCP    FAMILY:1453            localhost:1454         ESTABLISHED     4064
  [firefox.exe]

  TCP    FAMILY:1454            localhost:1453         ESTABLISHED     4064
  [firefox.exe]

  TCP    FAMILY:1455            localhost:1456         ESTABLISHED     4064
  [firefox.exe]

  TCP    FAMILY:1456            localhost:1455         ESTABLISHED     4064
  [firefox.exe]


C:\Documents and Settings\andrew.YOUR-B04E565902.000>

My ISP is virgin media.

[Broni]

I think, we got it.
Go to Add\Remove, and see, if you have Kontiki listed. If so, uninstall.
Restart computer, post fresh HJT log.

If it's not listed, let me know.
I'll be back in 10 minutes.

[AndrewKelly]

Its not in Add or Remove but I did a search for it and found a folder called Kontiki with 4 files; error, error 2, kservice.mdmp and zdata. Ill go ahead and delete these.

[Broni]

Hold on....

[Broni]

Go Start>Run, type in:
services.msc
Click OK.

Services window will open.
Find:
KService
Click on "Stop" link.
Wait until service stops.
Right click on KService, click Properties, and under Startup type, select Disable from drop-down menu.

Now, delete Kontiki folder.

Restart computer. Post new HJT log.

[AndrewKelly]

I didnt see your post before I went ahead and deleted them. The first file couldnt be deleted because it was in use by another program. I went into task manager and found something called KService.exe. I did a search on google and found this was linked to SkyPlayer which I downloaded about a week or so ago. So I stopped KService.exe in task manager, deleted those kontiki files returned by the search and deleted a folder called Kontiki in the Program Files folder.
The problem must be fixed now. The lights have returned to normal and my internet running at its normal speed.

Unless theres anything else remaining, thanks for all the help 

[AndrewKelly]

Go Start>Run, type in:
services.msc
Click OK.

Services window will open.
Find:
KService
Click on "Stop" link.
Wait until service stops.
taight click on KService, click Properties, and under Startup type, select Disable from drop-down menu.

Now, delete Kontiki folder.

Restart computer. Post new HJT log.

I didnt see this post before I deleted all traces of Kontiki instead of just disabling. Hope I havent messed up anything. Ill restart now and post the HJT log.

[Broni]

You did OK, but this is important step:

Right click on KService, click Properties, and under Startup type, select Disable from drop-down menu.

.
If not done, you're gonna be getting startup error.
Make sure, you perform the above step.
Then, post HJT log.

I'll be gone for couple of hours, pretty soon.

[Broni]

BTW....in the future, don't rush things. It's easy to mess up something.

[AndrewKelly]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:13:17, on 18/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: + Offline &Explorer: Download the link - file://C:\Program Files\Offline Explorer Pro\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://C:\Program Files\Offline Explorer Pro\Add_AllO.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: lxcr_device -   - C:\WINDOWS\system32\lxcrcoms.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe

--
End of file - 7884 bytes

Ill restart now to make sure there's no startup error.

[Broni]

KService is gone...good, but we have another problem.
You're running TWO antiviruses: Norton, and Avast. This is no-no.
One of them has to go.
Let me know, which one you want to keep, and DO NOTHING ELSE.