Problem with my 56K Dialup Connection

dcGT

Hi All,
Just thought I'd post this up to see if anyone has ideas. I connect to the internet at home via the old 56K modem to the IOL Free number. I have noticed recently that it's running very slow. So I had a look at the connection properties where it gives the number of bytes being sent and received. I noticed that there is always a lot more bytes being sent than received, even when I'm just looking at 1 or 2 web pages. Once, I connected to the internet and left it for a while, when I came back there had been 1.5 MB sent! and only a few thousand bytes received. I've also noticed that the longer I am connected the slower the connection gets because of all the uploading being carried out. Has anyone experienced this before? Or know what's causing it or how to get rid of it?

Cheers,

DC.

henbane

Use the IOL free at home myself. Outgoing traffic is rarely more than 10% of inbound and usually a lot less. I'd be inclined to think you have some p2p stuff running permanently in the background.

Could also be a trojan or some adware trash. Try spybot to check for anything like that and some anti-virus wouldn't hurt either.

Download a half decent software firewall (I've found sygate decent enough) to see what programs are making outbound connections whenever you dial.

dcGT

Cheers henbane! I thought it might be something like that. Just wasn't sure of the best way to get rid of it.

DC

vibe666

there's almost certainly something dodgy going on there. best to sort it in case it's doing something really bad like using you as a spam relay or something.

up to date antivirus definitions and as has been said already spybot s&d and/or ad-aware. run them both to be 100% sure and make sure you run updates for both pieces of software before you do a search.

and a decent firewall too (again, as has already been suggested).

it's very unusual for anyone doing normal surfing activity to have more data sent than received.

also get DU meter and it will tell you what and when is being sent praphically, so you can see how much data is going on on a graph kinda thing. very handy.

kikel

had the same problem myself until last night when i installed Norton Anti virus, Norton internet security and all the latest updates from microsoft. it took a while do get all the latest updates downloaded but now surfing is a pleasure again.

dcGT

Thanks for all the suggestions lads. I'll try installing NAV and spybot etc. and see how I get on....

Cheers!

DC.

Mossy Monk

i was going to start a thread on the same thing

it is happening to me on IOL Anytime and it is really slow :mad:
in 22 minutes i have sent just under 4,000,000 bytes and received just over 1,000,000 bytes. no P2P application running here

i am in the 058 area if that makes a difference

Spybot and Adaware show nothing to be wrong so i'll give norton a go

Mossy Monk

hmmmmmmmmm

i gave Norton a go and it came up with this

is that the bastard sending out data?

henbane

Originally posted by Mossy Monk
i gave Norton a go and it came up with this

is that the bastard sending out data?

Most definitely. It's a nasty little beast. Right now your machine is doing it's best to spread the infection too. If you're only using XPs firewall it won't even notice. That's why I recommended sygate up above cos it sees outbound connections and queries them so you can spot trojans easy nuff, though I reckon most reputable software firewalls should do the same job.

Follow their instructions for removal. Update windows for the RPC vulnerability. Two patches necessary as far as I remember (neither of which are in latest service pack either - newer than that). Then install a firewall.

Mossy Monk

thank you

Mossy Monk

Originally posted by henbane
Follow their instructions for removal. Update windows for the RPC vulnerability. Two patches necessary as far as I remember (neither of which are in latest service pack either - newer than that). Then install a firewall.

i'm not sure of what to d/l. any suggestions?

mickeyboymel

http://www.symantec.com/avcenter/FixWelch.exe. off the symantec site is the tool to remove the bug Mossy, just run it and follow the inst

mickeyboymel

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

sorry, this one might work!!! then after this has removed it, run windows update to make sure all is uptodate or search microsoft database for "welchia worm" to retrieve the nescessary patches

Mossy Monk

cheers

dcGT

Hi Lads,
Yeah just got rid of that welchia worm virus myself. Installed NAV, and Auto Protect picked it up when I dialed up. Went to Symantec site, got the fix and all is good again...
The report I had was ...

"The service "RpcPatch" is viral. It is deleted.

The service "RpcTftpd" is viral. It is deleted.

The tool has deleted the viral file "C:\WINNT\system32\wins\DLLHOST.EXE".

The file "C:\WINNT\system32\wins\svchost.exe" is deleted.

W32.Welchia.Worm has been successfully removed
from your computer!"

Cheers,

DC.

ZENER

I've beeing getting this a lot over the past few months. Customers complain of the computer wanting to dial out at start up - slow d/l's - poor performance - popup ads and general malade. On every cas I found they had installed Kazaa or Gator or Bonzai Buddy or the like ! These apps all come free with spyware and malware.

By running spybot ar similar you initially remove the offending files but at restart they reinstall them selves and the problem gets gradually worse again ! Very often uninstalling the filesharing app wont help alone. I'd suggest an app like Limewire as it seems a friendlier program and if you get the pro version it wont install any crap at all - of course if you are using XP you will also need the Java VM update from these terribly nice Sun people !!

Tinky