Internet/FTP stops working....

[Thraxen]

I have a strange problem that seems to have just started yesterday. I can be browsing the web just fine when suddenly I won't be able to load any web pages. Even if I restart my browser or change to a new one. Also, when this happens I can't FTP and I will get an error in FlashFXP that says, "No buffer space available". But I still have a connection because my XBox happened to be streaming an internet radio station at the time (it accesses the internet through a 2nd NIC in my PC) and it kept on streaming it in and playing music. The only way I can get things working normally is to reboot my PC. Any ideas on what could be causing this issue?

 

[Thraxen]

*bump*

 

[DetroitSportsFan]

"No buffer space available" refers to a condition affecting your tcp/ip stack. The usual culprit for this condition is your connections are maxed out. Have you installed XP sp2? SP2 limits your connections and its possible this could be part of the problem. However, under normal conditions, you should never reach your max connections limit. I've seen this problem on rigs running certain p2p software like edonkey .... and its usually on a win98 machine. I'm not familiar with your ftp software. Does it allow multi-source downloading?

What I don't know is what OS you're running, what other network programs you like to run, etc. This condition is rare on a win XP based machine. I've only seen it running moglo on a win XP machine, which had an issue of opening sockets but not closing them. After a while your connections get maxed out. When this happens, your internet connection seems to die. Strangely enough, anything that was already connected prior to your system reaching a maxed out connection state usually remains working.

In your case, I've identified whats causing your issue .... a maxed out connection state. What I don't know is why. Is it possible you've been infected by a virus or some other type of malware? Out of curiosity...if you run netstat -an from a command shell, how many open sockets appear? My suspicions are something is running on your system without you being aware. Or .... you're running a program you're aware of that is opening sockets but not closing them.

Lets start by updating and running your antivirus scan. Let me know what AV software you're using. Some are better than others, but none are 100%. Not to mention, many trojans are missed completely by AV software scans. In your situation, it may take some time and patience to identify the problem. I'd like to get as much information from you as possible before we proceed. Lets start by downloading HIJACKTHIS from HERE. Open the program and run the scan. Don't do ANYTHING else yet. Just save the results to a log and post the log here.

 

[DetroitSportsFan]

Bump ..... maybe others will have more input than I.

 

[Thraxen]

Hey, thanks for replying! I downloaded the most recent version of HijackThis and ran it. Rather than post the entire log into this post I just upped the log to some webspace. You can get it here: Log

Some more details... I'm running WinXP Pro, but I have not installed SP2. I installed it a few weeks ago and found that I could no longer FTP. I disabled the firewall and I still couldn't. I even made a post here but no one could/did help. So I uninstalled SP2. Maybe you can help there too 🙂 I'm running Norton AntiVirus 2005 and it is currently set to auto-update, so it should be current. As for network programs... I use Firefox 99% of the time for internet browsing. I ocassionally open IE to view a page that won't work correctly in Firefox. I FTP a lot. Both externally across the internet and locally to my XBox. The program I use is FlashFXP. I use Bittorent (BitTornado specifically) on a regular basis, usually to download a couple of anime series a friend and I keep up with. I also use mIRC on a pretty regular basis, but am normally on there only for a minute or so at a time. Not much else I can think of other than OE which I use as my e-mail client. Oh yeah, not sure if it's important, but my internet connection is PPPoE ADSL.

Thanks!

 

[imported_rhfactor]

O3 - Toolbar: Band Class - {BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8} - C:\WINDOWS\AdRoar.dll (file missing)

This tells me, you have or have had spyware/adware on your PC. Look for Winsocks XP fix. That might help you. It helped one of my PC's after I cleaned all the spyware.

 

[DetroitSportsFan]

First of all, its going to take a bit of time to research some of your HJT log entries. I'm not familiar with them all. I did notice you've got spybot S & D on your system. Lets update it and give it a run. I'm guessing that since you have it, you know how to use it so I won't waste time with instructions on that. After running spybot, run HijackThis again and post your new HJT log. If we're lucky, it will be smaller and take less time to work my way through.

Second, you mentioned bittorrent. That, other than some malware turning your computer into a webserver, is the most likely cause for the conditions you've described. I've never used any of the bittorent programs, but it is my understanding that you can garner an awful lot of connections and receive a download incredibly fast. Try recreating your "no buffer space available" error and then run "netstat -an" from the command prompt. My guess is you'll have more open sockets than you would want to count. Reboot so you can re-establish your internet connection. This time, don't run your bittorent, but run all your other programs you usually run. Run "netstat -an" again and compare the number of open sockets with what you had when bittorent was running full blast. You'll see the difference.

PPPoE .... I know what it is, but have never personally used it. I know the MTU value on a PPPoE connection is 1480 as apposed to the typical 1492 MTU of regular broadband. Beyond that, I can't answer whether or not it would have any great affect on your max connections. You DID mention ADSL though. DSL in general is has no "give" at all in your subscribed bandwidth. While you're running these bandwidth hog programs, you could also be introducing a lot of packetloss into your line. When you reach the line's limit, you begin to see alot of remix from requesting lost packets ..... which slows you down. Add into the mix that you're constantly uploading also at your line's limits ..... which further complicates the packetloss issue.

What can you do? Aside from the obvious of limiting your bittorent use to a time when you won't be using your other programs ..... you could consider running everything through an adsl/broadband router and removing that second NIC. You then would have the benefit of a hardware firewall which you could use to limit unwanted connections to your pc. Now a days, its not uncommon to find a broadband router on sale with a mail in rebate that makes it close to free.

Anyway .... check your system for spyware just to be sure. Also, use HOUSECALL from trend micro to get an informed opinion on whether or not your Norton is doing its job. I don't know much about Norton 2005, but I do know that the knock against Norton 2004 is it had a tendency to miss things that McAfee and PCillin would catch. Its possible that symantec is still a step behind the competition. In 2002, they were the king of the hill. Since then, they've slipped a notch because the competition has gotten much better. (If you look at the reviews, Norton gets solid ratings but other AV software is considered to be better.)

Post a new HJT log for me after you've scanned for spyware. Don't forget to update your definitions and close any open browser windows before you run the scan. Even though firefox is a much more secure browser, its possible that your p2p software had spyware bundled with it. One more thing ..... you said Norton 2005 but didn't mention running any software firewall. I suggest it because otherwise you're a sitting duck. I still recommend installing SP2, disabling the windows firewall. However, for now, lets get your "No buffer space available" problem solved before we attempt to get things working with SP2.

Once again, others are free to offer input. I'm only one man with one brain .... and I'm a true believer of the power of many brains combined.

O3 - Toolbar: Band Class - {BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8} - C:\WINDOWS\AdRoar.dll (file missing)

This tells me, you have or have had spyware/adware on your PC. Look for Winsocks XP fix. That might help you. It helped one of my PC's after I cleaned all the spyware.

Or LSPfix. Both repair the winsock layer.