[SOLVED] Bandwidth problem

[slyfox2151]

Hi

im running a home network of 3 Pc's on a cable connection.

the problem is we seems to be running out of download's quite fast compaird to normal. i have been monitoring the bandwidth of my computer for the last 40 odd days and recenty iv noticed that my pc constantly downloads 1.4KB/sec and uploads at 1.9Kb/sec this may not seem like that much but after 24 hours a day 30 days a month it adds up.

i ran netstat in command prompt and got the following
Tcp Mrcomp:3949 COLIN-9MBP8V0TY:netbios-ssn established
Tcp MRCOMP:3960 192.168.1.1:http CLOSE_WAIT

i thort it might just be transfering files between my pc and Colin-9 however when i shutdown the other Pc and disconnected it i was still Dling/uploading

not sure where exacly the info is going so i downloaded a few tools. Tcp viewer from microsoft shows svchost.exe 876 constantly chaiging ports going from port 1000 or so to 5001 then restarting over again only stoping breifly on every odd port.

i have looked around on the net about this and come up with nothing so far using google perhaps im not using the right search words.

ps i tried ending the Svchost.exe 876 via tcp viewer only to discover my music files could not be opend due to missing codecs or something both Wmp10 and classic could not play them i restarted and that fixed the problem. i ended the prosses again and the same thing happed.

pps. optuscable count downloads and uploads towards total monthly data allowance.

I have also installed bandwidth monitor on both other pc's and they show 0 upload and download speeds when sitting idle.

any 1 have any susgestions or anything at all plz help

http://img251.imageshack.us/img251/5...eenshottx6.jpg

*edit*
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:07:22 AM, on 13/11/2007
Platform: Windows 2003 SP2 (WinNT 5.02.3790) *windows X64 pro SP2*
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)
Boot mode: Normal

Running processes:
D:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
D:\Program Files (x86)\Raxco\PerfectDisk\PDAgent.exe
D:\WINDOWS\SysWOW64\PnkBstrA.exe
D:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files (x86)\BandwidthMonitor\BWMonitor.exe
D:\Program Files (x86)\Portrait Displays\forteManager\DTHtml.exe
D:\Program Files (x86)\Raxco\PerfectDisk\PDEngine.exe
D:\Program Files (x86)\Windows Media Player\wmplayer.exe
D:\PROGRA~2\MOZILL~1\FIREFOX.EXE
C:\HijackThis\HijackThis.exe

F2 - REG:system.ini: UserInit=userinit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files (x86)\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {BE2ED590-CA49-46B5-8CCE-244FB2E0D1AA} - (no file)
O4 - HKLM\..\Run: [DT LGE] "D:\Program Files (x86)\Portrait Displays\forteManager\DTHtml.exe" -startup_folder
O4 - HKCU\..\Run: [BandwidthMonitor] D:\Program Files (x86)\BandwidthMonitor\BWMonitor.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files (x86)\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files (x86)\Java\jre1.6.0\bin\ssv.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1190756431781
O16 - DPF: {C4D6755D-2123-4EEF-BAA0-94B22F1C2271} (IAHSOCX.HOSTILESPACE) - https://www.hostilespace.com/portal/IAHSOCX20019.CAB
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - D:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - D:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: Event Log (Eventlog) - Unknown owner - D:\WINDOWS\system32\services.exe (file missing)
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - D:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - D:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - D:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: Net Logon (Netlogon) - Unknown owner - D:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - D:\WINDOWS\system32\nvsvc64.exe (file missing)
O23 - Service: PDAgent - Raxco Software, Inc. - D:\Program Files (x86)\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files (x86)\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - D:\WINDOWS\system32\services.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - D:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - D:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - D:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - D:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - D:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - D:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: StyleXPService - Unknown owner - D:\Program Files (x86)\TGTSoft\StyleXP\StyleXPService.exe (file missing)
O23 - Service: Virtual Disk Service (vds) - Unknown owner - D:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - D:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - D:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)
O23 - Service: Windows Search (WSearch) - Unknown owner - D:\WINDOWS\system32\SearchIndexer.exe (file missing)

--
End of file - 5381 bytes

[johnwill]

Boot in safe mode with networking and see if the situation still occurs.

[slyfox2151]

in safemode with networking i have 0 upload/downlaods and svcchost.exe 876 dose not show up in tcpview.

back in normal mode i looked in tcpviewer it dosnt just lookup odd ports now its looking at every single port 1000 - 5000

[johnwill]

OK, so it's something running in normal mode, that was the object of the exercise.

Next, I'd try disabling all the stuff that starts with MSCONFIG and see if the problem surfaces. If it's gone, enable a couple at a time until it comes back. That will allow you to zero in on what's causing the issue.

[slyfox2151]

with process win.inf, load system services, load startup seems to be the only combo that the problem occers in.

it has now risen to around 5Kb up/down. i have double cheeked and cant find any program that could be using the net when idle.

[johnwill]

Win.inf isn't a process, it's a configuration file. Where are you seeing that?

[slyfox2151]

start, run, msconfig, selective startup, 2nd 1 down

[johnwill]

OK, that's process WIN.INI, not WIN.INF. I didn't pick up on that. WIN.INI is a legacy file left over from the 95/98 days, but still supported.

Are you saying that unchecking WIN.INI processing solves the issue? If so, the next step it to post the contents of the WIN.INI file, which is located in the \WINDOWS folder. You can open it with NOTEPAD.

[slyfox2151]

upon looking into the win.ini file i saw nothing unusual.
[Mail]
MAPI=1
[MCI Extensions.BAK]
wma=MPEGVideo
wax=MPEGVideo
wmv=MPEGVideo
wvx=MPEGVideo
mpeg=MPEGVideo
mpg=MPEGVideo
mpe=MPEGVideo
m1v=MPEGVideo
mp2=MPEGVideo
mpv2=MPEGVideo
mp2v=MPEGVideo
mpa=MPEGVideo
mp3=MPEGVideo
m3u=MPEGVideo
[MSUCE]
Advanced=0
CodePage=Unicode
Font=Arial

so i decided to retest the msconfig startup thing. this time it happend with just "load system services"

screen shot of command prompt after typing in tasklist /svc
http://img251.imageshack.us/img251/6...enshot2lq3.jpg

[johnwill]

Does it not happen if you don't check "load system services"? How about unchecking ONLY that and rebooting?

[slyfox2151]

no it dosnt

[johnwill]

OK, so "load system services" is where the issue is?

I suggest booting with and without that disabled and taking a screen shot of Task Manager's Processes tab with and without it. Compare the two lists and see what processes are not running when the problem is gone. Then we'll try to disable them one at a time until we stumble across the one that causes the issue.

[slyfox2151]

i have fixed the problem, it had something to do with terminal services.

i did the following

1. Right-click My Computer and select Manage.
2. In the Computer Management window, open the Services And Applications branch in the left pane and click Services.

3. In the Services pane, locate and double-click Terminal Services.
4. In the Terminal Services Properties dialog box, click the Stop button and then set the Startup Type setting to Disabled.

5. Click OK and then close the Computer Management window.
6. Restart Windows.

[johnwill]

Thanks for the feedback.