my settings don't work anymore

hocine · Post by **hocine** » Wed Jan 05, 2011 10:57 am

hi all,
i have a dsl 8Mbps. With tcpoptimizer, i used to set the following.
MTU: 1440
TTL: 64
RWIN: 128800
yes, no, yes, 2
windows scaling: checked
second "onglet"
10, 10
5, 6, 7, 8
Optimized
0, 0, 0, 0, 0, 0
32768

These settings used to work well and the tcp/ip analyzer used to recognize them...

But since a few days (surely i changed something) tcp/ip analizer gives me wrong settings although tcp optimizer is set like i described above!!!
i launched winsock to restart from scratch, but it doesn't fix it.
i uninstalled my cards and reinstalled them... but still nothing!!!
can you help me please!!!
thanks.

PS: xp sp3
ISP: global net (tunisia) with a cnet router

hocine · Post by **hocine** » Wed Jan 05, 2011 6:38 pm

No one interested with my problem???
What should i do to fix it!!!
thanks again

trogers · Post by **trogers** » Wed Jan 05, 2011 8:27 pm

Do a tracert to yahoo.com and post.

Run TCP Analyzer and post report.

hocine · Post by **hocine** » Thu Jan 06, 2011 4:49 am

here is the report

« SpeedGuide.net TCP Analyzer Results »
Tested on: 01.06.2011 04:47
IP address: 196.203.xx.xxx
Client OS: Windows XP

TCP options string: 020405780103030101010402
MSS: 1400
MTU: 1440
TCP Window: 32768 (NOT multiple of MSS)
RWIN Scaling: 1 bits (2^1=2)
Unscaled RWIN : 16384
Recommended RWINs: 64400, 128800, 257600, 515200, 1030400
BDP limit (200ms): 1311kbps (164KBytes/s)
BDP limit (500ms): 524kbps (66KBytes/s)
MTU Discovery: ON
TTL: 46
Timestamps: OFF
SACKs: ON
IP ToS: 00000000 (0)

hocine · Post by **hocine** » Thu Jan 06, 2011 5:17 am

#1 wblindix.sdv.fr 0.28 ms
#2 border-gateway1.sdv.fr 0.96 ms
#3 cbv-10g-6-1.sdv.fr 7.64 ms
#4 xe-2-2-0.par22.ip4.tinet.net 6.96 ms
#5 xe-1-0-0.par20.ip4.tinet.net 7.28 ms
#6 Te-7-4.car1.Paris1.Level3.net 15.84 ms
#7 ae-34-52.ebr2.Paris1.Level3.net 7.78 ms
#8 ae-5-5.car1.Geneva1.Level3.net 50.20 ms
#9 YAHOO-INC.car1.Geneva1.Level3.net 28.91 ms
#10 gi-1-4.bas-a2.ch1.yahoo.com 28.70 ms
#11 ir1.fp.vip.ch1.yahoo.com 31.65 ms

hocine · Post by **hocine** » Thu Jan 06, 2011 5:19 am

#1 wblindix.sdv.fr 0.49 ms
#2 border-gateway1.sdv.fr 98.48 ms
#3 cbv-10g-6-1.sdv.fr 7.49 ms
#4 xe-2-2-0.par22.ip4.tinet.net 7.31 ms
#5 xe-3-0-0.was12.ip4.tinet.net 85.46 ms
#6 as10310.ip4.tinet.net 116.95 ms
#7 ae-6.pat1.dce.yahoo.com 94.95 ms
#8 ae-6.pat1.che.yahoo.com 110.94 ms
#9 ae-2-d110.msr2.mud.yahoo.com 139.44 ms
#10 te-7-2.fab1-a-gdc.mud.yahoo.com 139.92 ms
#11 te-9-1.bas-c2.mud.yahoo.com 139.92 ms
#12 ir1.fp.vip.mud.yahoo.com 139.93 ms

trogers · Post by **trogers** » Thu Jan 06, 2011 11:14 am

hocine wrote:
TCP Window: 32768 (NOT multiple of MSS)
RWIN Scaling: 1 bits (2^1=2)
Unscaled RWIN : 16384

Using Kaspersky? Disable port 8080 in Kaspersky.

hocine · Post by **hocine** » Thu Jan 06, 2011 12:14 pm

no i use norton internet security... but anyway it used to work well before!!!

trogers · Post by **trogers** » Fri Jan 07, 2011 8:33 am

hocine wrote:no i use norton internet security... but anyway it used to work well before!!!

Something is holding your RWIN at 32768. Post a Hijackthis log.

hocine · Post by **hocine** » Fri Jan 07, 2011 9:09 am

ok for highjackthis... just a moment!!!

hocine · Post by **hocine** » Fri Jan 07, 2011 9:12 am

there it is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:10:55, on 07/01/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
C:\Program Files\TeamViewer\Version6\TeamViewer.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
C:\Program Files\TeamViewer\Version6\tv_w32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Documents and Settings\Hocine.PROBOOK_4510S\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hocine.PROBOOK_4510S\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hocine.PROBOOK_4510S\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hocine.PROBOOK_4510S\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hocine.PROBOOK_4510S\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Hocine.PROBOOK_4510S\Bureau\divers\marrant\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://y.lo.st/?xt=first
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\IPSBHO.DLL
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Hocine.PROBOOK_4510S\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Envoyer à Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 4833934562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 4896492171
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.co ... 3.13.0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{210A922A-420C-4102-863B-85D69F5E5087}: NameServer = 192.168.0.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Service de configuration Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Microsoft .NET Framework NGEN v4.0.30319_X86 (clr_optimization_v4.0.30319_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (file missing)
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

--
End of file - 9162 bytes

trogers · Post by **trogers** » Fri Jan 07, 2011 10:06 am

hocine wrote:
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

Try removing this using the following guide:

http://www.pchell.com/support/nwprovau_dll_file.shtml

Then run WinsockFix and see if TCP window reverts to default 65535. If yes, use TCP Optimizer to set Rwin value.

hocine · Post by **hocine** » Fri Jan 07, 2011 10:09 am

ok and thanks for your help... err how can i verify the value of TCP windows?

trogers · Post by **trogers** » Fri Jan 07, 2011 11:49 am

hocine wrote:ok and thanks for your help... err how can i verify the value of TCP windows?

TCP Analyzer can show the value of TCP Window in most cases.

hocine · Post by **hocine** » Fri Jan 07, 2011 11:54 am

Ok here are the news...
i did the procedure twice... but it didnt work. after executing the tool to remove the dll, highjackthis says it is removed. then i execute winsockfix, reboot... do a new highjackthis and the 010 line comes back!!!
what can i do know???

trogers · Post by **trogers** » Sat Jan 08, 2011 11:09 am

hocine wrote:Ok here are the news...
i did the procedure twice... but it didnt work. after executing the tool to remove the dll, highjackthis says it is removed. then i execute winsockfix, reboot... do a new highjackthis and the 010 line comes back!!!
what can i do know???

This could be due to your computer having some Netware application.

What is this teamviewer application?

C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

hocine · Post by **hocine** » Sat Jan 08, 2011 11:51 am

teamviewer is a small software that makes me communicate with my other computers, transferring files, do repairs, chat etc...
but i have to say that my issue is quiete recent! i use teamviewer for more than a year and it didn't cause this situation.
by the way. i now don't have that dll... but still can't get my parameters be recognized!!! here is my new highjacthis report:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:50:22, on 08/01/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\TeamViewer\Version6\TeamViewer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
C:\Program Files\TeamViewer\Version6\tv_w32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Atheros\ACU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Documents and Settings\Hocine.PROBOOK_4510S\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hocine.PROBOOK_4510S\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hocine.PROBOOK_4510S\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hocine.PROBOOK_4510S\Bureau\divers\marrant\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://y.lo.st/?xt=first
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\IPSBHO.DLL
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\1.1.2\pdfforgeToolbarIE.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Envoyer à Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 4833934562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 4896492171
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.co ... 3.13.0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{210A922A-420C-4102-863B-85D69F5E5087}: NameServer = 192.168.0.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Service de configuration Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Microsoft .NET Framework NGEN v4.0.30319_X86 (clr_optimization_v4.0.30319_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (file missing)
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

--
End of file - 8057 bytes

trogers · Post by **trogers** » Sat Jan 08, 2011 2:17 pm

Run this test: http://nitro.ucsc.edu/

Post the report under the 'More Details' button.

hocine · Post by **hocine** » Sat Jan 08, 2011 2:50 pm

here it is:

WEB100 Kernel Variables:
Client: localhost/127.0.0.1
CurMSS: 1400
X_Rcvbuf: 103424
X_Sndbuf: 103424
AckPktsIn: 132
AckPktsOut: 0
BytesRetrans: 8400
CongAvoid: 46
CongestionOverCount: 0
CongestionSignals: 4
CountRTT: 74
CurCwnd: 4200
CurRTO: 990
CurRwinRcvd: 128800
CurRwinSent: 16304
CurSsthresh: 2800
DSACKDups: 0
DataBytesIn: 0
DataBytesOut: 270200
DataPktsIn: 0
DataPktsOut: 193
DupAcksIn: 53
ECNEnabled: 0
FastRetran: 4
MaxCwnd: 30800
MaxMSS: 1400
MaxRTO: 1380
MaxRTT: 700
MaxRwinRcvd: 128800
MaxRwinSent: 16304
MaxSsthresh: 15400
MinMSS: 1400
MinRTO: 760
MinRTT: 440
MinRwinRcvd: 16384
MinRwinSent: 16304
NagleEnabled: 1
OtherReductions: 0
PktsIn: 132
PktsOut: 193
PktsRetrans: 6
RcvWinScale: 7
SACKEnabled: 3
SACKsRcvd: 55
SendStall: 0
SlowStart: 27
SampleRTT: 640
SmoothedRTT: 550
SndWinScale: 1
SndLimTimeRwin: 0
SndLimTimeCwnd: 10898169
SndLimTimeSender: 24401
SndLimTransRwin: 0
SndLimTransCwnd: 1
SndLimTransSender: 1
SndLimBytesRwin: 0
SndLimBytesCwnd: 270200
SndLimBytesSender: 0
SubsequentTimeouts: 0
SumRTT: 36970
Timeouts: 0
TimestampsEnabled: 0
WinScaleRcvd: 1
WinScaleSent: 7
DupAcksOut: 0
StartTimeUsec: 648351
Duration: 11020016
c2sData: 2
c2sAck: 2
s2cData: 8
s2cAck: 2
half_duplex: 0
link: 0
congestion: 1
bad_cable: 0
mismatch: 0
spd: 0.20
bw: 0.15
loss: 0.020725389
avgrtt: 499.59
waitsec: 0.00
timesec: 10.00
order: 0.4015
rwintime: 0.0000
sendtime: 0.0022
cwndtime: 0.9978
rwin: 0.9827
swin: 0.7891
cwin: 0.2350
rttsec: 0.499595
Sndbuf: 103424
aspd: 0.00000
CWND-Limited: 46.57
minCWNDpeak: 2800
maxCWNDpeak: 30800
CWNDpeaks: 4

The theoretical network limit is 0.15 Mbps
The NDT server has a 50.0 KByte buffer which limits the throughput to 1.57 Mbps
Your PC/Workstation has a 125.0 KByte buffer which limits the throughput to 1.96 Mbps
The network based flow control limits the throughput to 0.47 Mbps

Client Data reports link is 'T1', Client Acks report link is 'T1'
Server Data reports link is 'OC-48', Server Acks report link is 'T1'

trogers · Post by **trogers** » Sun Jan 09, 2011 8:53 am

hocine wrote:here it is:

CurMSS: 1400

CurRwinRcvd: 128800

MaxMSS: 1400

MaxRwinRcvd: 128800

MinRwinRcvd: 16384

The theoretical network limit is 0.15 Mbps
The NDT server has a 50.0 KByte buffer which limits the throughput to 1.57 Mbps
Your PC/Workstation has a 125.0 KByte buffer which limits the throughput to 1.96 Mbps
The network based flow control limits the throughput to 0.47 Mbps

Client Data reports link is 'T1', Client Acks report link is 'T1'
Server Data reports link is 'OC-48', Server Acks report link is 'T1'

This test shows that your TCP Window (Rwin) has been set to 128800 and MTU is at 1440.

Thus, TCP Analyzer may not be reading your TCP Window right. Were you using Chrome browser? Try using FF or IE.

hocine · Post by **hocine** » Sun Jan 09, 2011 9:05 am

yep i use chrome, but i also tried out with firefox and internet explorer... same results!!!
i really don't know what happens and what to do???

trogers · Post by **trogers** » Sun Jan 09, 2011 1:06 pm

hocine wrote:yep i use chrome, but i also tried out with firefox and internet explorer... same results!!!
i really don't know what happens and what to do???

The NDT tested your connection and reported a TCP Window of 128800. Thus it is set to what you have desired, unless you want to double it to 257600 for a line speed of 8 Mbps or higher.

hocine · Post by **hocine** » Sun Jan 09, 2011 1:24 pm

Then why does why tcp/ip analyzer gives wrong results??? knowing that before it used to give me the right ones (the ones i set up in tcp optimizer)???

trogers · Post by **trogers** » Sun Jan 09, 2011 8:36 pm

hocine wrote:Then why does why tcp/ip analyzer gives wrong results??? knowing that before it used to give me the right ones (the ones i set up in tcp optimizer)???

The Analyzer takes a snapshot of the connection properties. If there is some intermediate host between the browser and the Analyzer (eg. proxy server) then the Analyzer may be reading the properties of this host, and not your comp.

The NDT is a dynamic test, and thus read the properties of the connection between your comp and the test server, like maxRwin, CurRwin and MinRwin, etc.