cancel
Showing results for 
Search instead for 
Did you mean: 

Disappearing 2GB allowance

PhilT
Newbie
Posts: 5
Registered: 05-12-2007

Disappearing 2GB allowance

I'm trying to help a lady out who is on a 2GB package - the allowance is eaten within days of her billing date and then the service speed is restricted until next billing date. One option would be to change package to the newer 10 GB ones, however......
Traffic management breakdown shows the traffic to be 99% HTTP and 1% streaming.
Wireless is used, WPA security was set and I changed the SSID & password, increased encryption to WPA2 and set a MAC exclusion limit on a different router to limit access to her PC.
When the Vista PC boots in safe mode there is no significant wireless traffic. When it boots in normal mode there is about 250 kbits/s of traffic on the wireless constantly, which is consistent with the rate of usage clocked by Plusnet. The PC has Norton Internet Security and scans clean with Malwarebytes and PrevX too.
Looking at the connections there's a single TCP connection from PID 1140 using local Port 49706 to Port 80 on IP 88.221.84.11 which has reverse DNS a88-221-84-11.deploy.akamaitechnologie....
Akamai do content distribution networks, so seem likely to be legit - but would would the process be that was hell bent on downloading flat out 24/7 ?
20 REPLIES
Plusnet Alumni (retired) orbrey
Plusnet Alumni (retired)
Posts: 10,540
Registered: 18-07-2007

Re: Disappearing 2GB allowance

Googling for the port number doesn't bring up anything in particular unfortunately, I was wondering if it was iPlayer or 4OD or similar but I believe they stopped their p2p method some time ago. Is there any way you can identify the PID in question, possibly it'll show in Task Manager?
Community Veteran
Posts: 26,637
Thanks: 867
Fixes: 10
Registered: 10-04-2007

Re: Disappearing 2GB allowance

If you install zonealarm that will request permission for opening every inbound or outbound port giving the name of the process asking for permission.
Have you looked to see if kservice is installed? If it is uninstall it! (it was what the iPlayer and 4oD used)
jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£13/month)
Mobile: iD mobile (£4/month)
Bremmy
Dabbler
Posts: 13
Registered: 05-06-2011

Re: Disappearing 2GB allowance

PID is svchost.exe. Could Vista be updating itself automatically? Iirc Microsoft use Akamai for distribution.
Plusnet Alumni (retired) orbrey
Plusnet Alumni (retired)
Posts: 10,540
Registered: 18-07-2007

Re: Disappearing 2GB allowance

Could well be that yes - go into your windows update settings (think there's an option in the control panel for that) and choose for windows to notify you of any updates but let you choose when to download and install them. Once that's set, reboot and see if the download stops?
PhilT
Newbie
Posts: 5
Registered: 05-12-2007

Re: Disappearing 2GB allowance

The tools I used suggested several processes used  PID 1140 including BITS which I think does the Windows Update.
Windows Update had checked the day before and was up to date, it didn't say it was in the process of downloading anything. Also 2GB seems too much even for Windows updates !
I found some similar smelling threads :-
http://www.majestic12.co.uk/projects/dsearch/mj12bot.php
https://forums.malwarebytes.org/index.php?showtopic=61901
although quite old the process ID, connecting to akamai etc seems similar. I think I'll bring her PC home and get stuck into what the processes are with a software firewall on there to guide me - thanks.
PhilT
Newbie
Posts: 5
Registered: 05-12-2007

Re: Disappearing 2GB allowance

Hmm, 1.7GB of downloads later (in a couple of hours) .......
Some of the sites it latches on to are things like Akamai, Windows update, Microsoft, Norton etc but then it goes and latches onto a random Entanet address.
Not pinned it down yet, but I can turn it on and off with a firewall.
Community Veteran
Posts: 38,460
Thanks: 1,027
Fixes: 62
Registered: 15-06-2007

Re: Disappearing 2GB allowance

look at Task Manager and show processes for all users and see what is running
PhilT
Newbie
Posts: 5
Registered: 05-12-2007

Re: Disappearing 2GB allowance

Doesn't help Jim, its one of the many svchost.exe processes
vultura
Grafter
Posts: 251
Thanks: 4
Registered: 22-05-2011

Re: Disappearing 2GB allowance

PhilT
Newbie
Posts: 5
Registered: 05-12-2007

Re: Disappearing 2GB allowance

thanks for the suggestions. Combofix got hold of it and stopped the downloads, though I am yet to figure out precisely how !
At least 2 Gbytes per day of download have stopped. Funny thing is there was practically no upload and I can't find any files of over 100k created during that time, apart from some Norton update definitions.
Mansn
Grafter
Posts: 41
Registered: 02-02-2010

Re: Disappearing 2GB allowance

Follow these steps:
- Uninstall Norton and reboot, it's the biggest heap of rubbish out there
- Install Microsoft Security Essentials
- Install Malwarebytes Antimalware and run
- Install CCleaner and run
- As an added bonus download auslogics disk defrag and run
These can all be found at www.filehippo.com and are free
Congratulations, your PC is now cleaner and much faster
Community Veteran
Posts: 26,637
Thanks: 867
Fixes: 10
Registered: 10-04-2007

Re: Disappearing 2GB allowance

Intrigued as to why you recommend Piriform's CCleaner but not their Defraggler!
jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£13/month)
Mobile: iD mobile (£4/month)
rongtw
Seasoned Hero
Posts: 6,786
Thanks: 1,408
Fixes: 12
Registered: 01-12-2010

Re: Disappearing 2GB allowance

Mansn, yup they are the best free programs around for cleaning your PC  Cool
jelv i have tried the defraggler and not impressed one i use is Perfect Disc 10  Wink
another program worth using to check process,s is  " Hijack This "
AND Norton is the biggest pile of poop around  Shocked
Asus ROG Hero Vii Z97 , Intel i5 4690k ,ROG Asus Strix 1070,
samsung 850evo 250gig , WD black 2 TB . Asus Phoebus sound ,
16 gig Avexir ram 2400 , water cooling Corsair H100i gtx ,
Corsair 750HXI Psu , Phanteks Enthoo pro case .
Community Veteran
Posts: 5,472
Thanks: 292
Fixes: 4
Registered: 11-08-2007

Re: Disappearing 2GB allowance

[quote=rongtw]Norton is the biggest pile of poop around    Shocked
I think you will find that that title belongs to Windows !
Reading this thread reminds me of all the reasons why I jumped ship from Windows to Ubuntu.
Constantly battling against the PC to do the simplest thing, when all you want to do is some web browsing or write a document, but instead throwing your hands in the air in despair and shouting "WHAT THE HELL IS IT DOING NOW !!!"
Running Windows is like being a parent to a helpless baby, keeping you awake at night, takes forever to wake up when you want to play, constantly needs feeding with updates, checking security every minute of the day, being on constant alert for what unexpected thing it's going to do next, and clearing up the poop after it has crashed again.
Running Ubuntu is more like an old friend, always available, cooperates with almost anything you ask of it and does it then and there, it can give you a full update in less than a minute, you only have to visit it's home every six months for a refreshing break, it costs you NOTHING to be up with the latest and greatest, and it NEVER lets you down.
As for the original problem of tracing active network connections, in Ubuntu you just open 'Firestarter' and look at the active connections to see what is going on.
If in the unlikely event more debugging is required then clicking the [Policy] button give you access to the networking controls, then selectively pass/block each connection/protocol/port.  Job done !