Hi, I have the following problem:
My ISP is offering me 4Mb downstream and 1Mb upstream. I
actually manage to get consistently the full download
speed, good ISP performance here. The upstream however is
a problem.
Sometimes I have the full 1Mb/s, sometimes it is very
slow. This variation in speed can occur in a matter of
seconds. As a test: If I upload a 1MB file to my ISP's
test server, the maximum speed is very low. 15 seconds
later I repeat this upload, and have the maximum upload
speed. But generally my upload speed is slow.
Curious thing: When I've the maximum upload speed, my CPU
doesn't have a problem at all. When the upload is slow, my
CPU is at 100%, like it's handling a big problem. This CPU
thing suggest there is actually a PC problem.
I've made a graph showing my upload (yellow) and CPU
(green), fist is the bad upload, followed the good upload.
Find the graph at:
http://rapidshare.de/files/991257/Performance_monitor.JPG.h
tml
If you can't see it, click on "Free" at the bottom of the
screen.
Running XP pro SP2
ZoneAlarm Security Suite 5.5 (switched on or off makes no
difference)
Run both limited user as administrator, no difference
either
Run both ZoneAlarm 1.0.1 and Internet Explorer
6.0.2900.2180
Everything is fully patched and updated.
Have re-installed my network drivers etc, nothing helped
so far.
What could be the cause of this?
Thanks,
Peter
Peter,
What is loading your CPU?
Get Process Explorer (free) from
<
http://www.sysinternals.com/ntw2k/freeware/procexp.shtml>. Provides way more
information than Task Manager. And Port Explorer (free) from
<
http://www.diamondcs.com.au/portexplorer/index.php?page=home> will show you
what network connections your computer is actually opening, and what processes
are opening them. Also, Autoruns (also free, and also from SysInternals)
<
http://www.sysinternals.com/ntw2k/freeware/autoruns.shtml> will show you
specifically what process are started automatically.
Next, with all due respect to ZoneAlarm, please do a malware check.
How current is your virus protection? Try one or more of these free online
virus scans, which should complement your current protection:
<
http://www.bitdefender.com/scan/license.php>
<
http://www.pandasoftware.com/activescan>
<
http://www.ravantivirus.com/scan/>
<
http://security.symantec.com/ssc/home.asp>
<
http://housecall.trendmicro.com/housecall/start_corp.asp>
Next check for, and learn to defend against, non-viral malware. Have you
downloaded these programs before? Download them again, as the latest version
may be needed to keep up with the current level of malware being attempted
constantly - get the absolutely most current version of each product listed.
They're all free - and most pretty small, so they download quickly enough.
Start by downloading each of the following additional free tools - and download
each individual product from each link as listed:
AdAware <
http://www.lavasoftusa.com/>
CWShredder <
http://www.majorgeeks.com/download4086.html>
HijackThis <
http://www.tomcoyote.com/hjt/>
LSP-Fix <
http://www.cexx.org/lspfix.htm>
WinsockXPFix <
http://www.spychecker.com/program/winsockxpfix.html>
Spybot S&D <
http://www.safer-networking.org/index.php?page=download>
Stinger <
http://us.mcafee.com/virusInfo/default.asp?id=stinger>
TrendMicro Engine <
http://www.trendmicro.com/download/dcs.asp>
TrendMicro Signatures <
http://www.trendmicro.com/download/pattern.asp>
TrendMicro Instructions <
http://www.trendmicro.com/ftp/products/tsc/readme.txt>
Create a separate folder for HijackThis, such as C:\HijackThis - copy the
downloaded file there. Create a separate folder for the two TrendMicro files,
such as C:\TrendMicro - copy the downloaded files there (unzipped if necessary).
AdAware, CWShredder, and Spybot S&D have install routines - run them. The other
downloaded programs can be copied into, and run from, any convenient folder.
First, close all Internet Explorer and Outlook windows.
Run Stinger. Have it remove all problems found.
Run CWShredder. Have it fix all problems found.
Next, disable System Restore.
<
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm>
Boot your computer into Safe Mode.
http://support.microsoft.com/?id=315222
Run C:\TrendMicro\Sysclean.com. Delete any infections found. Reboot your
computer, and re enable System Restore.
Next, run AdAware. First update it, configure for full scan
(<
http://forums.spywareinfo.com/index.php?showtopic=11150>), then scan. When
scanning finishes, remove all Critical Objects found.
Next, run Spybot S&D. First update it, then run a scan. Trust Spybot, and
delete everything ("Fix Problems") that is displayed in Red.
Then, run HijackThis ("Scan"). Do NOT make any changes immediately. Save the
HJT Log.
<
http://forums.spywareinfo.com/index.php?showtopic=227>
Finally, have your HJT log interpreted by experts at one or more of the
following security forums (and please post a link to your forum posts, here):
Aumha: <
http://forum.aumha.org/index.php>
Net-Integration: <
http://forums.net-integration.net/>
Spyware Info: <
http://forums.spywareinfo.com/>
Spyware Warrior: <
http://spywarewarrior.com/index.php>
Tom Coyote: <
http://forums.tomcoyote.org/>
If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.
Finally, improve your chances for the future.
Harden your browser. There are various websites which will check for
vulnerabilities, here are three which I use.
http://www.jasons-toolbox.com/BrowserSecurity/
http://bcheck.scanit.be/bcheck/
https://testzone.secunia.com/browser_checker/
Consider using an alternative browser, like Firefox, for the majority of your
browsing activities.
<
http://www.spreadfirefox.com/?q=affiliates&id=4507&t=61>
Block Internet Explorer ActiveX scripting from dangerous websites (Restricted
Zone).
<
https://netfiles.uiuc.edu/ehowes/www/main.htm> (IE-SpyAd)
Block known dangerous scripts from running.
<
http://www.javacoolsoftware.com/spywareblaster.html>
Block known spyware from installing.
<
http://www.javacoolsoftware.com/spywareguard.html>
Make sure that the spyware detection / protection products that you use are
reliable:
http://www.spywarewarrior.com/rogue_anti-spyware.htm
Harden your operating system. Check at least monthly for security updates.
http://windowsupdate.microsoft.com/
Block possibly dangerous websites with a Hosts file. Three Hosts file sources I
use:
http://www.accs-net.com/hosts/get_hosts.html
http://www.mvps.org/winhelp2002/hosts.htm
(The third is included, and updated, with Spybot (see above)).
Maintain your Hosts file (merge / eliminate duplicate entries) with:
eDexter <
http://www.accs-net.com/hosts/get_hosts.html>
Hostess <
http://accs-net.com/hostess/>
Secure your operating system, and applications. Don't use, or leave activated,
any accounts with names or passwords with trivial (guessable) values. Don't use
an account with administrative authority, except when you're intentionally doing
administrative tasks.
Use common sense. Yours. Don't install software based upon advice from unknown
sources. Don't install free software, without researching it carefully. Don't
open email unless you know who it's from, and how and why it was sent.
Educate yourself. Know what the risks are. Stay informed. Read Usenet, and
various web pages that discuss security problems. Check the logs from the
security products that you use regularly, look for things that don't belong, and
take action when necessary.
How did I get infected in the first place?
http://forums.net-integration.net/index.php?showtopic=3051
Essential tips for infection prevention
http://forums.spywareinfo.com/index.php?showtopic=24339
http://www1.spywareinfo.com/articles/hijacked/prevent.php
--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.
