Reviewers Recommend
Forbidden Love (Love Her Films)Forbidden Love (Love Her Films) - review by Captain Jack
Starring: Milan Ponjevic, Melissa Moore [II]. Read review
All Forums > Tech Talk > Tech Talk Forum Page 27 > Some programs are eating my bandwidth
AuthorPost
nietzsche
Deactivated User

5470 Posts
8/03
Posted - Mar 23 2008 : 10:28PM
I installed a bandwidth monitor yesterday and i notice the bandwidth is being eaten up at a rate of about 70kb a minute even when I'm idle. I have no idea what is doing this and was wondering if anyone knew of a freeware product that could tell me.
Walter All-Star Supporter
All-Star Member

1445 Posts
3/05
Posted - Mar 24 2008 : 12:07AM
Do you use:
an Antivirus?
a Firewall?
Spybot or Ad-Aware or something similar? (they sometimes capture other sorts of malware)
Do you find anything surprising when you bring up TaskManager (Ctr+Alt+Del on most machines)?
With that much bandwidth being used, it sounds to me like file sharing is taking place. A hacker or spyware program wouldn't need that much bandwidth to take whatever information they wanted.
By the way, I'm far from a guru, so you may wish to see if someone more knowledgeable has better advice. But if no one responds, you could try my advice.
Edited to delete reference to HijackThis. Apparently, you can screw up your OS if you don't know what you're doing with this program. Try using Spybot or Ad-Aware first.

Edited by - Walter on 3/24/2008 12:16:24 AM

conquistador
Deactivated User

Hellhamster.
2947 Posts
10/03
Posted - Mar 24 2008 : 12:25AM
ctrl-alt-delete and google the name of anything you don't recognize. Especially if it is using your ram.
It might be a pain in the ass but you'll get to know your system better.
Do you use wireless or is there a possibility that someone could be sharing your bandwidth?
XP or Vista?
nietzsche
Deactivated User

5470 Posts
8/03
Posted - Mar 24 2008 : 1:46AM
I think i have all the processes in taskmgr accounted for, but this doesn't help me. I need to know which one is sending data. Is there a program that will give me this info.
And yes I run anti-virus and several anti-spyware packages every day.
conquistador
Deactivated User

Hellhamster.
2947 Posts
10/03
Posted - Mar 24 2008 : 1:57AM
I don't know.
My only other suggestion is to download PeerGuardian 2 update all of the spyware (etc, whichever seems relevant)block lists and run the program and watch the activity.
If what is eating your band with stops while you have peer guardian active you may be able to catch what it is on the block list.
 
conquistador
Deactivated User

Hellhamster.
2947 Posts
10/03
Posted - Mar 24 2008 : 2:13AM
Drew Black
broken crankshaft

8009 Posts
9/99
Posted - Mar 24 2008 : 8:28AM
Have you ever run a rootkit revealer?
Have you tried Netstat?
nietzsche
Deactivated User

5470 Posts
8/03
Posted - Mar 24 2008 : 11:16AM
Here is my netstat. That one from cincinatti is weird.
~1.jpg
nietzsche
Deactivated User

5470 Posts
8/03
Posted - Mar 24 2008 : 11:18AM
it's not even legible.
Drew Black
broken crankshaft

8009 Posts
9/99
Posted - Mar 24 2008 : 8:31PM
The quickie uploader shrinks to a max of 800px wide. Use the other one. It shrinks to a max of 1024px.
blowfish
Member

874 Posts
1/08
Posted - Mar 24 2008 : 9:31PM
You P2P? Thats a big killer.
nietzsche
Deactivated User

5470 Posts
8/03
Posted - Mar 25 2008 : 2:16AM
nope.
RandomPrecision
Senior Member

Enjoy!
8175 Posts
3/06
Posted - Mar 26 2008 : 3:29AM
Does it still happen after a reboot?
nietzsche
Deactivated User

5470 Posts
8/03
Posted - Mar 27 2008 : 12:32AM
yes.
Harri Patel
Senior Member

#SDNY he's all yours. -- Michael Steele
5110 Posts
3/03
Posted - Mar 27 2008 : 1:44AM
Have you tried going through the Hijack This! rigamarole? There's a thread about it here
 
nietzsche
Deactivated User

5470 Posts
8/03
Posted - Mar 27 2008 : 1:58PM
I'll post the log here, but I'll try on their forums too.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:56:59 PM, on 3/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss. exe
C:\WINDOWS\system32\winlogon. exe
C:\WINDOWS\system32\services. exe
C:\WINDOWS\system32\lsass. exe
C:\WINDOWS\system32\svchost. exe
C:\WINDOWS\System32\svchost. exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice. exe
C:\WINDOWS\Explorer. exe
C:\WINDOWS\SYSTEM32\USRmlnkA. exe
C:\PROGRA~1\Grisoft\AVG7\avgcc. exe
C:\WINDOWS\SYSTEM32\USRshutA. exe
C:\WINDOWS\SYSTEM32\USRmlnkA. exe
C:\Program Files\PTBSync\PTBSync. exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched. exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield. exe
C:\WINDOWS\system32\ctfmon. exe
C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen. exe
C:\Program Files\CursorXP\CursorXP. exe
C:\Program Files\VCOM\PowerDesk\pddlghlp. exe
C:\WINDOWS\system32\spoolsv. exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr. exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc. exe
C:\PROGRA~1\Grisoft\AVG7\avgemc. exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm. exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent. exe
C:\Program Files\Spyware Terminator\rsser. exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter. exe
C:\Program Files\VMware\VMware Server\vmware-authd. exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2. exe
C:\WINDOWS\system32\vmnat. exe
C:\WINDOWS\system32\vmnetdhcp. exe
C:\Program Files\VMware\VMware Server\vmserverdWin32. exe
C:\Program Files\ShaPlus Bandwidth Meter\ShaPlus Bandwidth Meter. exe
C:\Program Files\Pidgin\pidgin. exe
C:\WINDOWS\system32\svchost. exe
C:\Program Files\Intel\NCS\Sync\NetSvc. exe
C:\wamp\wampmanager. exe
c:\wamp\bin\apache\apache2.2.8\bin\httpd. exe
c:\wamp\bin\mysql\mysql5.0.51a\bin\mysqld-nt. exe
C:\wamp\bin\apache\apache2.2.8\bin\httpd. exe
C:\Program Files\Skype\Phone\Skype. exe
C:\Program Files\Skype\Plugin Manager\skypePM. exe
C:\Program Files\Mozilla Firefox\firefox. exe
C:\Program Files\Agent\agent. exe
C:\Program Files\VCOM\PowerDesk\PDExplo. exe
C:\Documents and Settings\doug taylor\My Documents\zips\HiJackThis. exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - 06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - 761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA. exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc. exe /STARTUP
O4 - HKLM\..\Run: [PTBSync] C:\Program Files\PTBSync\PTBSync. exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched. exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield. exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ShaPlus Bandwidth Meter] "C:\Program Files\ShaPlus Bandwidth Meter\ShaPlus Bandwidth Meter" /s
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype. exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon. exe] C:\WINDOWS\system32\ctfmon. exe
O4 - HKCU\..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen. exe /nosplash
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP. exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw. exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw. exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw. exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw. exe /RUNONCE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader. exe
O4 - Startup: Dialog Helper.lnk = C:\Program Files\VCOM\PowerDesk\pddlghlp. exe
O4 - Startup: Port Monster.LNK = C:\Program Files\Zing Software\Port Monster\pm. exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA. exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL. exe/3000
O9 - Extra button: (no name) - 08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - 08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag. exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag. exe
O9 - Extra button: Messenger - FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs. exe
O9 - Extra 'Tools' menuitem: Windows Messenger - FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs. exe
O16 - DPF: D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: skype4com - FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice. exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc. exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr. exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc. exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc. exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService. exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT. exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService. exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc. exe
O23 - Service: Atomic Clock Synchronization (PTBSync) - ElmueSoft - C:\Program Files\PTBSync\PTBSync. exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd. exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent. exe
O23 - Service: Spyware Terminator Realtime Shield Service (rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\rsser. exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd. exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp. exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2. exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32. exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat. exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.8\bin\httpd. exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.51a\bin\mysqld-nt. exe
--
End of file - 8374 bytes
blowfish
Member

874 Posts
1/08
Posted - Mar 27 2008 : 7:19PM
You may want to try www.techguy.org. A great forum if your stuff is really messed up. Post your problem in the proper area and someone will walk you through a fix.
Hardware All-Star Supporter
All-Star Member

Your other left
14594 Posts
3/02
Posted - Mar 27 2008 : 7:47PM
Jesus you're running a bunch of crap. Try stopping programs that might be using the net and see what happens. Start with these:
Skype
jusched (java update scheduler)
Service: Atomic Clock Synchronization (PTBSync) - ElmueSoft - C:\Program
Files\PTBSync\PTBSync. exe
Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService. exe
Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc. exe
I suppose it it could be your VM manager passing messages between desktops, so see what happens when you stop that.
willywilly
Member

Activated Member
662 Posts
2/05
Posted - Apr 2 2008 : 8:12PM
Wouldn't a firewall that monitors both in and out tell him what was going on?
For a free firewall, I've often seen Comodo mentioned.
http://www.personalfirewall.comodo.com
nietzsche
Deactivated User

5470 Posts
8/03
Posted - Apr 2 2008 : 11:46PM
I use the windows firewall. Would a third party one be better?
conquistador
Deactivated User

Hellhamster.
2947 Posts
10/03
Posted - Apr 2 2008 : 11:50PM
Yes it would.
Try zone alarm. They have a free version which is superior to windows firewall. Other posters can probably recommend better but it is what I use and I like it.
Hardware All-Star Supporter
All-Star Member

Your other left
14594 Posts
3/02
Posted - Apr 3 2008 : 4:33AM
Nope, because the issue isn't who has access but who's generating all the traffic. All firewalls care about is whether a program is legitimate or not. It may consider certain behaviors as illegitimate but generating traffic isn't one of them.
Unless he's got a sniffer installed that will look at how many packets each programs is generating he's going to have to either find somebody who's already encountered the same problem and has the solution or he's going to have to take the path I indicated - stopping programs that access the internet until he find the culprit.
All Forums > Tech Talk > Tech Talk Forum Page 27Some programs are eating my bandwidth

Previous topic: Western Digital Ext HD Question.
Next topic: KVM Switch



Jump To: