Internet connection partially working.

[Unfocused]

My friend's got a problem with his Internet connection.

When he starts the system (WinXP) everything it fine for about 5 minutes. Then websites start loading really slowly and after another 3 minutes they cease to load completely. He can however use Xfire, for instance, and play on-line, though his server browser won't show any servers (he connects to servers via the favorites list).

Any ideas why is that happening and how to fix it? We tried resetting the TCP/IP protocal via the netsh winsock reset command, but that didn't help. We also tried turning off the firewalls completely. He did a system scan etc. and it doesn't seem that his PC is infected.

 

[Pesmerga]

tubes clogged

 

[Laivasse]

Some kind of denial of service attack maybe...? If you have any way of logging incoming connections, check to see if he's not getting spammed with dozens of connection attempts a second from random IP's.

 

[Unfocused]

Some kind of denial of service attack maybe...? If you have any way of logging incoming connections, check to see if he's not getting spammed with dozens of connection attempts a second from random IP's.

Ah, yes, I forgot about checking for that.

I asked him to run the netstat command and it returned this:

TCP marioosh:1066 cs.xfire.com:25999 USTANOWIONO
TCP marioosh:1081 checkip-ord.dyndns.com:http CZAS_OCZEKIWANIA
TCP marioosh:1099 170.121.222.3:microsoft-ds WYSŁANO_SYN
TCP marioosh:1100 197.112.167.51:microsoft-ds WYSŁANO_SYN
TCP marioosh:1101 132.14.94.4:microsoft-ds WYSŁANO_SYN
TCP marioosh:1105 134.42.245.2:microsoft-ds WYSŁANO_SYN
TCP marioosh:1106 81.63.19.88:microsoft-ds WYSŁANO_SYN
TCP marioosh:1107 d118-75-55-147.try.wideopenwest.com:microsoft-ds
WYSŁANO_SYN
TCP marioosh:1108 74-61-78-68.hon.clearwire-dns.net:microsoft-ds
WYSŁANO_SYN
TCP marioosh:kpop 131.38.196.126:microsoft-ds WYSŁANO_SYN
TCP marioosh:1110 33.126.244.106:microsoft-ds WYSŁANO_SYN
TCP marioosh:1111 103.7.192.38:microsoft-ds WYSŁANO_SYN
TCP marioosh:9129 marioosh.icpnet.pl:1082 CZAS_OCZEKIWANIA

It's in Polish unfortunately so:

USTANOWIONO - ESTABLISHED
CZAS_OCZEKIWANIA - AWAITING_TIME (?)
WYSŁANO - SENT (not sure what SYN is supposed to mean)

What's with all the microsoft-ds?

 

[Laivasse]

Sorry for coming across as if I know a damn thing, but I don't. That doesn't mean much to me I'm afraid.

I did turn up this, though, perhaps it'll grant an insight. Apparently 'microsoft-ds' means port 445.

 

[lePobz]

If ip-direct services still work when named services such as servers or websites fail to resolve then i'd point the finger squarely at the domain name server.

A good one to use is altohiway - 195.12.1.1