topic Re: Plusnet Value - possible overclocking? in Plusnet Feedback

Plusnet Value - possible overclocking?

jim2009 — Sun, 05 Oct 2014 21:07:23 GMT

I'm on Plusnet Value (no phone) and allowed 10GB downloads per month. For about the past 2 weeks I've noticed my usage is about double the normal. On using BitMeter, I noticed if I switch my laptop on and off during the day and go online each time, a mysterious 33MB is added on top of the normal usage I expected. Does anyone have an explanation for this or had a similar problem?

Re: Plusnet Value - possible overclocking?

picbits — Sun, 05 Oct 2014 21:30:01 GMT

Windows updates ?
Sometimes a failed update will try and download again. 33Mb isn't a huge amount to download but you might also want to download something like Networx which lets you monitor what is using your bandwidth.
Do you have any Apple software installed ? There have been recent issues where it has consumed large volumes of bandwidth without the users realising.

Re: Plusnet Value - possible overclocking?

x47c — Mon, 06 Oct 2014 06:58:46 GMT

Possibly a virus checker doing daily updates - some can be truly massive (100's of MB) when the database totally revised rather than just an update.
While Networx is good at monitoring usage on an hourly/daily/monthly basis as I recall it doesn't record what program/memory process is using it over what time frame.
Something like Sysinternals TCPview shows a real time log of what each internet connection from your computer is using at that moment in time.....but this does obviously require you to monitor it real time as well as once the connection has ceased the values recorded is removed from the display and then the data is lost.
I don't know of any program however which will log all of this to a file so that for example at the end of the day you can see a summary of exactly what program was connecting to the internet during the day or particular hour and how much it uploaded/downloaded during that time slot................and I'd be interested if there is one out there.

Re: Plusnet Value - possible overclocking?

adamwalker — Mon, 06 Oct 2014 10:00:37 GMT

Hi jim2009,
I'd definitely try a bandwidth monitor if this continues to concern you.
let us know how you get on.

Re: Plusnet Value - possible overclocking?

jim2009 — Mon, 06 Oct 2014 17:55:50 GMT

Thanks for all your help. Not Microsoft updates as I receive prior notificaion. I see I have Apple Application support and Apple updater - not sure why so I've uninstalled them.
I'm sending a log of events to Plusnet online - I hate using their call centre because of the VERY LOUD music they play while on hold. I don't wish to go deaf prematurely!

Re: Plusnet Value - possible overclocking?

MattyC — Mon, 06 Oct 2014 17:57:50 GMT

Hi jim2009,
I'd be interested in seeing this.
Whilst it is a very minimal amount of usage, it would probably be sensible to identify the cause of it.
Matty

Re: Plusnet Value - possible overclocking?

jim2009 — Wed, 08 Oct 2014 20:28:58 GMT

I installed ttB Meter to discover where those mysterious 32 MB downloads were coming from. It seems they are updates from Bullguard (anti-virus) and I'd been getting three or four of these per day since about September 23.
Bullguard's reply was -"our updates are indeed not that large."
For example, today I had six updates: Four of them were 32 MB, (but one before 8 am) one at 300 kB and the other less than 1 MB. My limit is 10 GB per month which works out at just over 300 MB per day. I've e-mailed Bullguard to ask then to let me know the actual size of the updates that have been sent to me recently.

Re: Plusnet Value - possible overclocking?

All4One — Thu, 09 Oct 2014 11:43:46 GMT

To avoid the worry of hitting your cap, why not upgrade to Unlimited? It can't be that much more per month, if not equal?!

Re: Plusnet Value - possible overclocking?

Acassim — Thu, 09 Oct 2014 12:14:52 GMT

Hi jim2009,
I'm glad to read that it seems you've found the culprit!
It sounds like this is just the virus definitions updating as and when each new definition becomes available.

Re: Plusnet Value - possible overclocking?

jim2009 — Sat, 11 Oct 2014 07:09:19 GMT

Solved the problem at last! The strange downloads were caused by malware called "Offer4U" - I'd run 2 full scans by Bullguard but had not detected it. I contacted them and advised I download AdwCleaner to scan and clean. It seems to have worked. My thanks to all who've given advice on the matter.

Re: Plusnet Value - possible overclocking?

picbits — Sat, 11 Oct 2014 09:10:49 GMT

Glad you got it sorted and thanks for posting back what the issue was
You might (as above) want to look at the unlimited packages and see if they could be worth moving to for your own peace of mind - often you can eat up data allowance by the most innocent looking things - I've seen a Windows Update from 8 to 8.1 eat 3Gb of data in very little time.

Re: Plusnet Value - possible overclocking?

MattyC — Mon, 13 Oct 2014 08:32:06 GMT

Quote from: jim2009
Solved the problem at last!

What a relief! I didn't really know what else to suggest.

Re: Plusnet Value - possible overclocking?

Anotherone — Tue, 14 Oct 2014 06:50:43 GMT

Malwarebytes is another excellent package for removing problematic spyware, malware and tracking cookies etc.

Re: Plusnet Value - possible overclocking?

jim2009 — Tue, 14 Oct 2014 13:24:03 GMT

I spoke too soon! Despite full scans by Bullguard, scans with AdwCleaner and MalwareBytes (removed 3 PUPs) I've had 3 of those mysterious downloads today - each about 32MB. It sounds drastic but would going back to my laptop's factory settings be any use - I expect that is the same as formatting the hard drive?

Re: Plusnet Value - possible overclocking?

TORPC — Tue, 14 Oct 2014 14:02:19 GMT

Use a Factory Reset as a last resort
In the meantime use Emsisoft Emergency Kit (The Emsisoft Emergency Kit contains a collection of programs that can be used without installation to scan for malware and clean infected computers.)
Or you could use their FULL free 30 day trial version http://www.emsisoft.com/en/software/antimalware/
Kaspersky's TDSSKiller
&
Hitman Pro (Make sure you choose the correct version for your infected machine, eg. 32bit) also choose run on this computer one time (don't worry you can re-rerun it again )

Re: Plusnet Value - possible overclocking?

Anonymous — Thu, 16 Oct 2014 11:31:23 GMT

Hi,
I agree with TORPC, doing a factory reset would be a last resort, as you'll have to update the OS, then update the updates as well.
I don't know what kind of download speed you have but I assume these downloads take time to complete, and happen when your laptop starts up. If this is the case then may I suggest that you run a command prompt as soon as possible after start up and enter:
netstat -afo 2 > dump.txt
This will log every connection on every port and write it out to a file called dump.txt and update every 2 seconds. (Press Ctrl+C to cancel) In the file created you'll find all of the connections made while netstat was running and the FQDN of applicable connections. A quick analysis of this log file might shed some light on the matter for you.
I hope this helps.
--
Mook

Re: Plusnet Value - possible overclocking?

jim2009 — Fri, 17 Oct 2014 07:32:51 GMT

Thanks TORPC - I tried Emsisoft Emergency and Kaspersky TDSSKiller and neither found any threats.
Thanks Mook for your suggestion - I'll try that. I don't mind going to factory settings. When I had XP I formatted the hard disk every 2 years to remove junk. Just had a note from Microsoft - 15 updates to install. Let's see if that does any good!

Re: Plusnet Value - possible overclocking?

TORPC — Fri, 17 Oct 2014 15:06:42 GMT

Following up on Mooks advice for running netstat -afo 2 > dump.txt
You will find the dump.txt file in C:\Users\YourPCName\dump.txt