sent/received not balanced

[Guest]

hi,
im running xp sp1...my LAN status shows Sent packets in high volumes ( more
than 13 digits ) but received packets are in the range of couple of thousands
packets. i am runnin 100 mbps lan to connect to the internet...i have
installed a free firewall, but it does not seem to slow down the flow of Sent
packets...shall i try something else?...thanking you in advance,
prasanna

 

[Malke]

hi,
im running xp sp1...my LAN status shows Sent packets in high volumes (
more than 13 digits ) but received packets are in the range of couple
of thousands packets. i am runnin 100 mbps lan to connect to the
internet...i have installed a free firewall, but it does not seem to
slow down the flow of Sent packets...shall i try something
else?...thanking you in advance, prasanna

What antivirus program do you have installed - name and version? What
does a scan in Safe Mode with it (using updated definitions) show?

Malke

 

[Guest]

I hav Norton 2003..i scanned with it in safemode earlier and have
quarintined 2 viruses...the problem has not gone....I have looked into system
processes and found one suspicious program "winexec32.exe"....once i disable
this one, outgoing datarate slows down considerably, though not fully...any
suggestions?

 

[Malke]

I hav Norton 2003..i scanned with it in safemode earlier and have
quarintined 2 viruses...the problem has not gone....I have looked into
system processes and found one suspicious program
"winexec32.exe"....once i disable this one, outgoing datarate slows
down considerably, though not fully...any suggestions?

http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.kazwin.html

Are you still using Kazaa? Is your subscription to NAV current and are
your definitions up-to-date?

Following the removal steps in the Symantec article above.

Malke

 

[Guest]

Im afraid your solution didnt work. Later, I formatted my HDD , installed a
fresh copy of XP with SP2, NAV 2003 with current updates, spybot S&D with
current updates . ive scanned my current configuration with NAV and Spybot ,
in Safe Mode . . I dont have any other softwares explicitly installed in my
system. YET THE PROBLEM IS NOT GONE.

 

[Malke]

Im afraid your solution didnt work. Later, I formatted my HDD ,
installed a fresh copy of XP with SP2, NAV 2003 with current updates,
spybot S&D with current updates . ive scanned my current configuration
with NAV and Spybot , in Safe Mode . . I dont have any other softwares
explicitly installed in my system. YET THE PROBLEM IS NOT GONE.

Sorry, but without actually looking at your machine it's impossible for
me to tell what's going on. If you are sure your computer is 100% clean
(and it should be since you formatted and clean-installed and did not
connect to the Internet without av and a firewall in place), then there
must be something on your system that is creating the traffic. You can
use a program like Ethereal if you are skilled at reading that sort of
data. Otherwise, do some clean boot troubleshooting or have a local
professional take a look at your system. Someone on-site can quickly
see what is happening far better than people reading posts in a
newsgroup.

http://support.microsoft.com/default.aspx?kbid=310353 - How to Perform a
Clean Boot in Windows XP

Malke

 

[Chuck]

hi,
im running xp sp1...my LAN status shows Sent packets in high volumes ( more
than 13 digits ) but received packets are in the range of couple of thousands
packets. i am runnin 100 mbps lan to connect to the internet...i have
installed a free firewall, but it does not seem to slow down the flow of Sent
packets...shall i try something else?...thanking you in advance,
prasanna

Prasanna,

Since you have already explored the anti-spyware and anti-virus possibilities
with Malke's advice, just maybe your traffic is coming from a legit application.

As Malke suggests, you could use Ethereal. Simpler than that is Port Explorer
(free) from <http://www.diamondcs.com.au/portexplorer/index.php?page=home> to
show you what network connections your computer is actually opening, and what
processes are opening them. And Process Explorer (free) from
<http://www.sysinternals.com/ntw2k/freeware/procexp.shtml>. Provides way more
information than Task Manager.

The current version of Port Explorer includes bandwidth total figures for each
process, so you should be able to identify the process generating traffic quite
easily.

OTOH, NAV and Spybot, though excellent in their respective fields, neither are
100% authoritative. See what Port Explorer points you towards, then look at
alternative anti-spyware and anti-virus products.

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.