Forum Settings
       
Reply To Thread

EQ - Nightly Link Death @ 9:04pmFollow

#1 Jan 17 2004 at 9:49 PM Rating: Good
Every night that I play EQ, at exactly 9:04pm, I go link dead. I'm pretty sure it has something to do with my computer and not my DSL since I'm on a hub and Merri's computer doesn't go LD.

Info:

Windows XP Professional 5.1
AMD-K7 Processor
256MB RAM

I don't have a virus checker and I don't have any scheduled tasks (that I'm aware of or can find).

If you need any other info let me know.

Any idea why it's doing this? It got my group killed tonight, which sucks, and it's just annoying as hell anyway. =)

Thanks in advance for any help.

Aren't you proud of me, Kao? I ventured out of OOT to post here!
#2 Jan 18 2004 at 11:26 AM Rating: Excellent
Avatar
******
29,919 posts
Yay! we'll make a tech support forum junkie out of you yet!

Let's see, a couple things it could be. The exact timing of it is interesting. First thing that comes to mind is a trojan virus that is on a timer. I would run http:\\housecall.trendmicro.com

you also might want to run ad aware from http:\\www.lavasoftusa.com

The other two possibilities that come to mind immidiatly. A. some program is trying to run an update, or loading that is large enough that it is taking up all your available ram, or B. soumewhere there is an electrical appliance that is automatically turning itself on at that time, causing an undervolt condition to the video card and making Bad Things happen.

Go to start:run and type in msconfig . Check the services list and startup list for any automatically loading programs that you don't really need all the time. Things like winamp and quicktime come to mind. Also check the icon list down by the clock in the lower right hand corner of your screen. If you could list what icons you have there, that could be helpful.

Known auto update culprits to watch out for are: microsoft mice and keyboard drivers, anything made by logitech, especially their cameras, Some creative labs cards, Windows itself, and aardvarks (ok, maybe not that last one, but you never know)

I would also try running a defrag, just in case

In the everquest directory there is a file called debug.txt. can you post the contents of it after the next crash?

I'll see if I can't think of anything else.
#3 Jan 18 2004 at 1:55 PM Rating: Good
Kaolian,

My task bar was running Mozilla, NDIVIA <sp?> video card, and sound. I removed Mozilla and NDIVIA.

I'm just home for lunch and have to go back to work in a few minutes. I'll run Adaware when I get home, and Defrag before I leave.

>A. some program is trying to run an update, or loading that is large enough that it is taking up all your available ram,

Any way I can find out what might be running?


>B. soumewhere there is an electrical appliance that is >automatically turning itself on at that time

Shouldn't be anything in our house doing that.


>the video card and making Bad Things happen.

I did install that video card mentioned in that other thread. I don't think that is the problem though, I seem to recall that back when I quit EQ for the 90th time 7 months ago, I was going LD on a timed schedule then too.


>Go to start:run and type in msconfig .

Only problem with this is, I disabled most of them before and had problems. My mouse scroll wheel wouldn't work and Winamp would lock up. I honestly don't know which ones I need and don't need, even after looking them up online.


What Housecall found:
~~~~~~~~~
JS.NoClose

Virus type: Trojan
Destructive: No
Aliases: Trojan.JS.NoClose, TROJAN.NOCLOSE, JS.TROJAN.NOCLOSE, HTML.JSCRIPT.NOCLOSE, JS/NoClose.gen
Pattern file needed: 272
Scan engine needed: 5.200

Description:

This non-destructive, non-memory resident JavaScript malware opens and hides one or more Internet browser windows and prevents users from controlling these browser windows.

This script malware, which is usually embedded in certain Web sites, opens browser windows to connect to a pre-defined list of URLs contained in its body. Infected users may encounter difficulties in viewing, maximizing, and closing these windows while unknowingly running this malware's hidden functions.
~~~~~~~~

It says that it runs with IE, and I use Mozilla. Also, I've never had any problem with my browser windows. I deleted the file, as they suggested.

Thanks for your help, Kao. I'll let you know the results (if any) of Adaware. I also plan to sit and watch my PC tonight at 9:04 (at the desktop) and see if anything pops up.
#4 Jan 18 2004 at 6:29 PM Rating: Good
Ran Adware. It found 10 tracking cookies and 1 mysterious folder (all deleted now). Defrag ran fine and finished. Found Scheduled Tasks but it's empty.

Decided it would be better to log on EQ around 9pm to see if it LDs again. If so, I will send you the debug file and then promptly smash my computer into tiny little pieces.

=)


Edit: Kao, I tried to email you a few hours ago and got it back saying it couldn't deliver it. I just hit reply, so I'm not sure why it didn't go. =/ Just an FYI.

Edited, Sun Jan 18 20:52:08 2004 by Angua
#5 Jan 18 2004 at 8:51 PM Rating: Excellent
Avatar
******
29,919 posts
That trojan may be it. The everquest patcher is built on an internet explorer platform, and to a lesser degree the everquest server connections also use IE. Even if you are not using it, it could be using it and flooding your connection to the point it locks up.

Edit:
if you want, post your msconfig file lists, and I can tell you which ones you can safely nuke.

Edited, Sun Jan 18 20:52:28 2004 by Kaolian
#6 Jan 18 2004 at 8:54 PM Rating: Excellent
Avatar
******
29,919 posts
Angua wrote:

Edit: Kao, I tried to email you a few hours ago and got it back saying it couldn't deliver it. I just hit reply, so I'm not sure why it didn't go. =/ Just an FYI.
Edited, Sun Jan 18 20:52:08 2004 by Angua


Can you check which address it was replying to? My rr address should theoretically be functional, but I never know with that one. My erau address is down. They broke it.
#7 Jan 18 2004 at 8:57 PM Rating: Good
Okay! You're such an angel.

Under Startup tab:

NvCpl
nwiz

Under Services tab:

Windows Audio
DHCP Client
DNS Client
Server
Workstation
TCP/IP NetBios Helper
Net Logon
NVIDIA Display Driver Service
Plug and Play
Remote Procedure Call (RPC) Locator (says it is essential)
Remote Procedure Call (RPS) says it is essential
Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
Web Client


Going to go log on EQ to see what happens at 9:04 =)

Thanks again for all your help. =)
#8 Jan 18 2004 at 9:11 PM Rating: Good
9:04pm, like clock work. =( Gah!

This is all that was in the debug file under the Everquest directory:

SisaOpenComms rdp_create beginSisaOpenComms rdp_create endSisaOpenComms rdp_create success

Nothing was running when it finally made it back to my desktop. I'm going to run Housecall again right now.

/cry

Btw, the email I used was your rr one.
#9 Jan 18 2004 at 9:24 PM Rating: Excellent
Avatar
******
29,919 posts
All of those are essential windows functions, so I guess you have that pared down as far as it will go.

I'll go kick my e-mail account, maybe it's sleeping.
#10 Jan 18 2004 at 9:27 PM Rating: Excellent
Avatar
******
29,919 posts
Another thought: is there any network application on Merrikat's computer that might be checking your computer at that time? Also, what network card do you have? is it set to release and renew IP addresses ever 24 hours?

edit, could be a corrupted network stack, try doing a repair install of the network protocals, or run this:
http://members.shaw.ca/techcd/VB_Projects/WinsockFix.zip



Edited, Sun Jan 18 21:30:38 2004 by Kaolian
#11 Jan 19 2004 at 12:47 PM Rating: Good
Quote:
Another thought: is there any network application on Merrikat's computer that might be checking your computer at that time?


Shouldn't be. We are connected via hub but in no other way.


Quote:
Also, what network card do you have? is it set to release and renew IP addresses ever 24 hours?


SMC EZ Card 10/100 PCI (SMC1211TX)

From Advance Tab:
Link Speed/Duplex Mode = Auto Mode
Network Address = Not Present
Receive Buffer Size = 64K bytes

How do I check to see if it releases and renews?



Quote:
edit, could be a corrupted network stack, try doing a repair install of the network protocals, or run this:
http://members.shaw.ca/techcd/VB_Projects/WinsockFix.zip


Ran it. It said repaired but didn't tell me if it actually found anything wrong.



Edited, Mon Jan 19 12:54:35 2004 by Angua
#12 Jan 19 2004 at 6:16 PM Rating: Default
Ok, I didn't see this mentioned anywhere, although I could have missed it. You don't have any "utility" programs set to run on your computer at any specific times do you? I know that my antivirus plays havoc with EQ whenever it tries to run and I have EQ up and going.

Also, you mentioned that you have a hub. What kind of hub is it? Is it also a firewall such as Linksys? If so, there are some timeout values there that may be terminating your account. I know that I can restrict my daughters computer based on time from the Linksys....

Just a couple of thoughts....
#13 Jan 19 2004 at 9:29 PM Rating: Good
9:24pm, Kao, and I'm still on EQ. =) Thanks so much for your help. Not sure what fixed it (maybe the stack thing), but it seems to be okay now. Course, I went LD at 5pm, but that may have just been random.

*hug*

#14 Jan 20 2004 at 6:33 AM Rating: Excellent
Avatar
******
29,919 posts
Woohoo!!!!! Glad that worked. I too have no idea what fixed it, but i'll take it, he he.
Reply To Thread

Colors Smileys Quote OriginalQuote Checked Help

 

Recent Visitors: 10 All times are in CST
Anonymous Guests (10)