caddman

My internet connections have been running slow for web pages and downloads. My HJT scan looks fine to me so I contacted RR support about my problem thinking that maybe there is something going on with thier end. They connected ran some program and told me that there are several connections to my computer. They asked me to run netstat and provide them with the report but provided no sloution. More or less they told me to try another spyware program..What was I thinking..??..
So, I turned to you guys here..

I have a wireless router for a laptop and my desktop is connect with a LAN line. Its my desk top that is having the problem. Here is my netstat report..

Active Connections

Proto Local Address Foreign Address State
TCP FAMILY:epmap FAMILY:0 LISTENING
TCP FAMILY:microsoft-ds FAMILY:0 LISTENING
TCP FAMILY:1029 FAMILY:0 LISTENING
TCP FAMILY:1032 localhost:40000 ESTABLISHED
TCP FAMILY:3216 localhost:3217 ESTABLISHED
TCP FAMILY:3217 localhost:3216 ESTABLISHED
TCP FAMILY:3704 localhost:6999 TIME_WAIT
TCP FAMILY:3706 localhost:6999 TIME_WAIT
TCP FAMILY:3708 localhost:6999 TIME_WAIT
TCP FAMILY:6999 FAMILY:0 LISTENING
TCP FAMILY:40000 FAMILY:0 LISTENING
TCP FAMILY:40000 localhost:1032 ESTABLISHED
TCP FAMILY:netbios-ssn FAMILY:0 LISTENING
TCP FAMILY:3701 64.233.163.99:http ESTABLISHED
TCP FAMILY:3703 64.233.163.99:http ESTABLISHED
TCP FAMILY:3705 pop-server.woh.rr.com:pop3 TIME_WAIT
TCP FAMILY:3707 pop-server.woh.rr.com:pop3 TIME_WAIT
TCP FAMILY:3709 pop-server.woh.rr.com:pop3 TIME_WAIT
UDP FAMILY:microsoft-ds *:*
UDP FAMILY:1037 *:*
UDP FAMILY:1047 *:*
UDP FAMILY:1352 *:*
UDP FAMILY:1353 *:*
UDP FAMILY:40116 *:*
UDP FAMILY:ntp *:*
UDP FAMILY:1900 *:*
UDP FAMILY:ntp *:*
UDP FAMILY:netbios-ns *:*
UDP FAMILY:netbios-dgm *:*
UDP FAMILY:1900 *:*


I have never heard of netstat until tonight.. So what does all of this mean..??..
Other than Family is the name of my desktop..!!..

Squashman

There are application that you can run to tell you what program is using each one of those connections.

Fport should help identify what programs are using all those connections.
http://www.foundstone.com/knowledge/proddesc/fport.html

Active Ports can do the same thing.
http://www.protect-me.com/freeware.html

TCPview from Sysinternals will help as well.
http://www.sysinternals.com/Utilities/TcpView.html

caddman

Thanks for the quick reply..
After looking at all three I choose TCPView. Below is the report of the ones that are always in use.

ALG.EXE:2676 TCP FAMILY:1030 FAMILY:0 LISTENING
PcCtlCom.exe:248 TCP FAMILY:1026 localhost:40000 STABLISHED
PcCtlCom.exe:248 UDP FAMILY:40116 *:*
SVCHOST.EXE:1024 TCP FAMILY:epmap FAMILY:0 LISTENING
SVCHOST.EXE:1120 UDP FAMILY:ntp *:*
SVCHOST.EXE:1120 UDP family.woh.rr.com:ntp *:*
SVCHOST.EXE:1240 UDP FAMILY:1049 *:*
SVCHOST.EXE:1240 UDP FAMILY:1034 *:*
SVCHOST.EXE:1316 UDP FAMILY:1900 *:*
SVCHOST.EXE:1316 UDP family.woh.rr.com:1900 *:*
System:4 TCP FAMILY:microsoft-ds FAMILY:0 LISTENING
System:4 TCP family.woh.rr.com:netbios-ssn FAMILY:0 LISTENING
System:4 UDP FAMILY:microsoft-ds *:*
System:4 UDP family.woh.rr.com:netbios-ns *:*
System:4 UDP family.woh.rr.com:netbios-dgm *:*
TmPfw.exe:1704 TCP FAMILY:40000 FAMILY:0 LISTENING
TmPfw.exe:1704 TCP FAMILY:40000 localhost:1026 ESTABLISHED
tmproxy.exe:1728 TCP FAMILY:6999 FAMILY:0 LISTENING

Didn't report on as many as nstat did last night. I guess I will need to watch it over a few days to see what it looks like. I was able to find out waht everything is except System:4 stuff..!!.. Its greek to me.. Any thoughts..??..

TMP*.exe are my firewall things
PCc*.exe is my viruse protection
Alg.exe - Internet search show it's a required Microsoft product
SVCHOST.EXE - also a reguired Microsoft DLL manager. Anyone know why there are so many..??..

Is there anything wrong with having so many ports be used/active..??..
My guess is that the list above it probably not causing my internet connection to be slow. Would anyone agree..??..

DumbTerminal

Did you look over your HJT log yourself, or did you get help at a forum?
If you didn't get help, I would suggest posting your log and have an expert double check it for you.
Log reading isn't as cut and dried as people think. It takes a long time to properly learn what to spot in logs

As far as the above results, I'm not real familiar with TCPView, but at a glance everything looks legit

caddman

Yes, I looked it over myself.. I'm not an expert or anything. But I had some browers high jack crap a few years ago and the experts in this forum helped me fix it. So, what I did after they gave me the thumbs-up I made a log of the current scane at that time.. I use it to compare with when I run a scan.. Sure, Ihave loaded software since then, but so far as long as I remove anything that was not in the list from a few years ago I have been running great..

Nonetheless, your point is well taken.. I'll post something over under the HJT forum..

Thanks for all your help... Although, I'm still wondering what is causing the web pages and downloads to be slow.. I wouldn't be suprised if RR is working on some upgrades in my area causing the noticable delays..

nickster_uk

Have you tried an online speed test to help diagnose any possible problems?

http://www.adslguide.org.uk/tools/speedtest.asp

:-)