Internet Speed and Bandwidth problem !!

I've recently come across a new problem in my internet usage experience. My net has become

pretty slow these days. even sites like google homepage takes upto a minute to open. When i

found out the connection statistics, i found the following entries repeated quite a number

of times times at many instances.

Instance 1

TCP pc:1xxx cds6.lga.llnw.net established

Instance 2

TCP pc:2xxx cds481.lga.llnw.net established


I access the net through authentication through a network server, which is on a lan. The

server is a non-windows server. I'm using Avira Antivirus. And the pc is quite busy even

when it is idle(even though its been less than a week since i've formatted the pc). I'm

using Windows Xp professional, with service pack 2 installed. The automatic updates service

of microsoft windows is turned on too. Also to be noted, i have installed only 5 softwares,

all of which are trustable(i had also installed google talk, which i have uninstalled now).

Can this be some spyware/malware installed in my windows registry??

Please help me out in this situation !

Pull up Task Manager and see what's running on there. Are you
downloading anything? Run "netstat -a" from a cmd prompt upon
booting up to see what connects to the web (try tcpview or active
ports if you want more details).

Bandwidth issues could be anything. There could be some shaping
in place on your network. You could be running some rogue apps
like spyware or malware. Try an online scan if you can and maybe
HiJackThis. Could be a lot of network users and only so much bandwidth
(been there, done that).

The company that owns that address is Limelight Networks ( http://www.limelightnetworks.com/ ). They appear to be a media stream hosting company. A quick search revealed that others were having this problem, and traced it back to the SearchMe robot. Are you hosting any websites?

Sorry, no websites hosted on this pc. When i did netstat -a , it showed that the 17xx series of ports were assigned to this limelight networks connecton. My connection is 64kbps line, and while i write this reply, the download speed for a mere 800kb hijack this is aboout 1 kbps(and only wmp and automatic updates are running) ! I'm using opera 9.5 now , previously i was using opera 9.4, even then the problem was exhibited. Here's what an old version of hijack this gave me in startup list

StartupList report, 6/21/2008, 10:33:20 AM
StartupList version: 1.52
Started from : E:\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.5730.0011)
* Using default options
* Including empty and uninteresting sections
==================================================

Running processes:

F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
F:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
F:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
F:\WINDOWS\system32\wuauclt.exe
F:\Program Files\Windows Media Player\wmplayer.exe
F:\Opera\opera.exe
F:\WINDOWS\system32\wuauclt.exe
E:\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[F:\Documents and Settings\Prateek\Start Menu\Programs\Startup]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[F:\Documents and Settings\All Users\Start Menu\Programs\Startup]
*No files*

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = F:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

avgnt = "F:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = F:\WINDOWS\system32\mshta.exe "%1" %*

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from F:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from F:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

*No BHO's found*

--------------------------------------------------

Enumerating Task Scheduler jobs:

*No jobs found*

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = F:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx
CODEBASE = http://fpdownload2.macromedia.com/ge...sh/swflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: F:\WINDOWS\System32\mswsock.dll
NameSpace #2: F:\WINDOWS\System32\winrnr.dll
NameSpace #3: F:\WINDOWS\System32\mswsock.dll
Protocol #1: F:\WINDOWS\system32\mswsock.dll
Protocol #2: F:\WINDOWS\system32\mswsock.dll
Protocol #3: F:\WINDOWS\system32\mswsock.dll
Protocol #4: F:\WINDOWS\system32\rsvpsp.dll
Protocol #5: F:\WINDOWS\system32\rsvpsp.dll
Protocol #6: F:\WINDOWS\system32\mswsock.dll
Protocol #7: F:\WINDOWS\system32\mswsock.dll
Protocol #8: F:\WINDOWS\system32\mswsock.dll
Protocol #9: F:\WINDOWS\system32\mswsock.dll
Protocol #10: F:\WINDOWS\system32\mswsock.dll
Protocol #11: F:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: F:\WINDOWS\system32\_000008_.tmp.dll||F:\WINDOWS\system32\SET14.tmp => F:\WINDOWS\system32\rpcss.dll|F:\WINDOWS\system32\SET15.tmp => F:\WINDOWS\system32\olecli32.dll|F:\WINDOWS\system32\SET16.tmp => F:\WINDOWS\system32\ole32.dll|F:\WINDOWS\system32\SET24.tmp => F:\WINDOWS\system32\gdi32.dll|F:\WINDOWS\system32\_000003_.tmp.dll||F:\WINDOWS\system32\SET32.tmp => F:\WINDOWS\system32\fltmc.exe|F:\WINDOWS\system32\SET33.tmp => F:\WINDOWS\system32\fltlib.dll|F:\WINDOWS\msagent\SET3B.tmp => F:\WINDOWS\msagent\agentdpv.dll|F:\WINDOWS\system32\SET57.tmp => F:\WINDOWS\system32\netman.dll|F:\WINDOWS\system32\_000007_.tmp.dll||F:\WINDOWS\system32\SET60.tmp => F:\WINDOWS\system32\iphlpapi.dll|F:\WINDOWS\system32\SET61.tmp => F:\WINDOWS\system32\dnsapi.dll|F:\WINDOWS\system32\SET75.tmp => F:\WINDOWS\system32\rasmans.dll|||

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: F:\WINDOWS\system32\SHELL32.dll
CDBurn: F:\WINDOWS\system32\SHELL32.dll
WebCheck: F:\WINDOWS\system32\webcheck.dll
SysTray: F:\WINDOWS\System32\stobject.dll
WPDShServiceObj: F:\WINDOWS\system32\WPDShServiceObj.dll

--------------------------------------------------
End of report, 12,911 bytes
Report generated in 0.320 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Here's what the new version of hijact this gave .

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:45:06 AM, on 6/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
F:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
F:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
F:\Program Files\Windows Media Player\wmplayer.exe
F:\Opera\opera.exe
F:\WINDOWS\system32\wuauclt.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe
F:\WINDOWS\system32\wuauclt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://codecs.r8.org/
O4 - HKLM\..\Run: [avgnt] "F:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E42CFF1-E666-439E-8B83-4E79C18551A8}: NameServer = 172.16.0.1
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - F:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - F:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

--
End of file - 2365 bytes

Here's what the new version of hijackthis gave .

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:45:06 AM, on 6/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
F:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
F:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
F:\Program Files\Windows Media Player\wmplayer.exe
F:\Opera\opera.exe
F:\WINDOWS\system32\wuauclt.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe
F:\WINDOWS\system32\wuauclt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://codecs.r8.org/
O4 - HKLM\..\Run: [avgnt] "F:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E42CFF1-E666-439E-8B83-4E79C18551A8}: NameServer = 172.16.0.1
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - F:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - F:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

--
End of file - 2365 bytes

Quote:

---

Originally Posted by sumitprateek

Sorry, no websites hosted on this pc. When i did netstat -a , it showed that the 17xx series of ports were assigned to this limelight networks connecton. My connection is 64kbps line, and while i write this reply, the download speed for a mere 800kb hijack this is aboout 1 kbps(and only wmp and automatic updates are running) ! I'm using opera 9.5 now , previously i was using opera 9.4, even then the problem was exhibited. Here's what an old version of hijack this gave me in startup list

---

Wow, 64 kbps is pretty damn slow. 50 kbps was about tops for a dial-up connection. HiJackThis looks clean, real clean. That thing should be running fast. Any idea what app is connecting the 17xx ports to Limelight? Try Active Ports to find out:

http://www.download.com/Active-Ports...-10062969.html

My gut reaction is it's not your PC, but the network. Is there an admin there?

Limelight Networks? I knew I'd seen that before. That's iPod territory. I've seen
iTunes/iPod connecting to Limelight during sniffing sessions.

You gotta lot of downloading going on there? That would explain your bandwidth
issues.

I have traced that the following windows files are connecting to that site

ws2_32.dll
winhttp.dll

What are these files for??? Why can they be connecting to that site?

I have traced that the following windows files are connecting to that site

ws2_32.dll
winhttp.dll

They are being executed by svchost.exe


What are these files for??? Why can they be connecting to that site?

And one more thing, there are three instances of svchost.exe running.
One initiated by the user
2nd initiated by the system
3rd initiated by network service !!

You say you connect via a lan..................... are the other users experiencing the same as you?

Is this problem consistent or does it happen at particular times of the day?

Do you have an individual account with your ISP or is it collective with the other users?

Unfortunately, when you are sharing a network connection with others, it only takes a few selfish and irresponsible people to spoil it for everyone :(

I dont know if they're facing the same problem as i'm doing. yes, its an Individual account with the ISP. Well, it can be some smart network geek that might have did this, but this is hardly possible, as the system is completely firewalled by windows firewall, and the connections are made my system's svchost.exe file !!

Quote:

---

I dont know if they're facing the same problem as i'm doing.

---

It might be an idea if you found out?

I would also contact your ISP and get them to test your connection.

Quote:

---

but this is hardly possible, as the system is completely firewalled by windows firewall

---

You cannot be serious :D

Quote:

---

and the connections are made my system's svchost.exe file !!

---

Not really relevant IMO.

If someone else is controlling your lan, they control your connection.

It's normal to have 3 or more instances of svchost.exe running on a
system. This XP install is running 6 as I type.

Both ws2_32.dll and winhttp.dll are Microsoft files. From the sound
of it, you've got some app using the .dll's to connect to a legit site.

Thanx broken crow !!
"
but this is hardly possible, as the system is completely firewalled by windows firewall"

i was serious, the users here in the lan are too dumb to understand networking, and frankly to say, i know a bit more about network loopholes and exploitations than the admin himself.

But there si one thign that i noticed.When windows update is not downloadding anything, the connections arer not established. Funny to find, windows update sometimes says that there are files which have just been downloaded, and you need to install them,even whn i've just turned on the pc, and havent connected to the net. Just now when i started the pc, it showed that the pc hasnt been restarted since the last time it installed the updates, and asks me to restart the pc immediately. WTF can this be?? Is it that windows update has some malicious stuff in it ??? I just simply cannot understand. This is the first of its kind scene i've seen !

And one more thing, The file svchost.exe is now establishing connections with 207.123.56.126 at the 2xxx port series.

I'm wondering if maybe WMP is causing all of this? It could be recieving from a Limelight hosted stream. Check your plug-ins and such.