mystery traffic

[john coley]

Hi vmfriend, to demonstrate what I said about performance I've pasted recent test results below. As you'll see, other than for one dip the speeds are pretty normal.
Date Download Speed Upload Speed
Today 14:18 47449 kbps (5.93MB/s) 1667 kbps (208kB/s)
Today 07:39 48499 kbps (6.06MB/s) 1674 kbps (209kB/s)
Yesterday 19:46 42869 kbps (5.36MB/s) 1675 kbps (209kB/s)
Friday 16:55 45150 kbps (5.64MB/s) 1673 kbps (209kB/s)
Friday 13:00 43716 kbps (5.46MB/s) 1662 kbps (208kB/s)
Friday 12:41 29648 kbps (3.71MB/s) 1665 kbps (208kB/s)
Thursday 18:39 43592 kbps (5.45MB/s) 1672 kbps (209kB/s)
Thursday 16:59 44929 kbps (5.62MB/s) 1662 kbps (208kB/s)
Thanks,
John.

[vmfriend]

Are these while downloading a file ?

[john coley]

Hi vmfriend, no. They're just tests done at random on the mybroadbandspeed.co.uk website.
Sorry the formatting's messed up. I pasted the text into notepad, and that plays havoc with formatting. It could also be down to my screenreader. The first figure is line speed, the second download speed, and the third upload speed.
Thanks,
John.

[vmfriend]

As I said before, VM are the only ones who will be able to confirm how the data was downloaded.

Tis a strange one.

[john coley]

Hi vmfriend, I've sent an email to neil berkett, so hopefully we'll see some action on it. I'll report back.
Thanks,
John.

[vmfriend]

Good Luck

[john coley]

Hi vmfriend, just thought I'd post with an update. I emailed CEO. I had requested they email me, but in the event a guy called Raj from CEO rang me yesterday, bank holiday Monday. He said he'd pass the issue to network and would ring me again when there was any news. Given the possibility that a change of modem could sort this I rang VM today. Eventually, having been passed from one department in India to another and getting nowhere the guy put me through to the retention guys in Teasside. Spoke to a guy called Paul who was very helpful. He's arranged for my modem to be changed, at the same time I'm downgrading to the 30 meg service, as I haven't been getting the benefit of 50 meg. He said though that it would be best to hold back from downgrading me on the system until they've got to the bottom of this mystery traffic issue, as were I downgraded with that issue still unsolved I'd be jumped on from the start. The downside is that I'm going still to be charged for the 50 meg service, but only have the 30 meg, so I hope they get their skates on to sort it. I've emailed CEO again to try to contact Raj, the guy who rang me yesterday, asking that he contact me as a matter of urgency, so here's hoping. A friend had suggested also that I run Hijackthis, to check my computer for bots or other nasties, so I have. I've pasted the results here. Could I have your thoughts, or indeed those of anybody who knows what to look out for. Here are the Hijackthis results.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:56:50, on 26/04/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Freedom Scientific\JAWS\11.0\jfw.exe
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
C:\Program Files\Freedom Scientific\JAWS\11.0\JHOOKLDR.EXE
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://labs.google.com/accessible/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O2 - BHO: SimpleAdblock Class - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Common Files\Simple Adblock\SimpleAdblock.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.co.UK/
O16 - DPF: {3D0D2821-8011-4B1F-BE9C-27B8E74CFBEF} (VM_ActX_2 Control) - http://downloads.virginmedia.com/CST/ver1/VM_ActX_2.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1269765047179
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1269790138468
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: JFWService - Freedom Scientific BLV Group, LLC - C:\Program Files\Freedom Scientific\JAWS\11.0\jfw.exe
O23 - Service: JTVNCProxy_11.0 - Unknown owner - C:\Program Files\Freedom Scientific\JAWS\11.0\JTVNCProxy.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe


Thanks,
John.
--
End of file - 5132 bytes

[jtaylor06]

Just had a look through your log and it looks safe to me
Nothing out of the ordinary.

Edit:
Just checked again and noticed FlashGet, which is a download manager.
Sometimes this has known to be a threat according to http://www.threatexpert.com/files/flashget.exe.html

Are you aware of FlashGet Download manager being on your computer?

[john coley]

Hi Jordan, yes. I've used Flash Get for years. I like it because it's fully screenreader accessible.
Thanks,
John.

[jtaylor06]

Originally Posted by john coley

Hi Jordan, yes. I've used Flash Get for years. I like it because it's fully screenreader accessible.
Thanks,
John.

Ah, just making sure
I do not see any Anti-virus or security programs being used?
Can you confirm whether you are using one or not?

If not, I would recommend Avast since it is free and uses Speech and sound to alert users of viruses or malware - which would be very beneficial to you.

To download Avast, click here

[DABhand]

Why they making you pay 50mb price on 30mb... that's not right, even if it is for 1 month. Or perhaps it was too late and they already processed your bill for this month and you will get a credit on next bill?

[john coley]

Hi Jordan, I generally use Microsoft Security Essentials. Due to a power problem VM Had as of last week, which slowed the internet and email to a crawl and made life very difficult, MSE was making a bad situation worse by slowing it even more, as it was examining every last thing, so I removed it till they've sorted the power problem and the service is back to normal. Obviously I don't want to be without protection for long, but it really was making it unuseable.
Thanks,
John.

---------- Post added at 07:42 ---------- Previous post was at 07:37 ----------

Hi DABhand, it's anone's guess. Mind you, I've emailed CEO for the attention of the guy who rang me yesterday to update him, and to ask them to get their finger out on finding the problem as I won't appreciate being charged for a service I'm not goint to be getting.
Incidentally, hope you and everybody had a nice Easter,
Thanks,
John.

[DABhand]

Easter is like another set of days in the year at my age, at your age... young man. But yeah it's been a long time since I last had a choccy egg

[john coley]

Never Mind DABhand, it's ages since I had one too. Thanks for the compliment, by the way.
Thanks,
John.

[john coley]

Hi DABhand, thought I'd give you all an update. As I said earlier for general little day to day things I use a little Dell, which is up to the job, but extremely low on resources. Microsoft Security Essentials hadn't found anything on it, so I'd assumed all was well. What had slipped my mind though was that the scan defaults to quick scan, which doesn't look everywhere, just in the most likely places.
Last night I did a full scan, and it found ten nasties. They were all in the Sun folder. Eight of them had exploit before the name, one was a trojan downloader, and another had open connection in the name. I uninstalled Java, then set folder options to show hidden files, and removed all traces of Sun and java. I then ran regedit and removed all java keys. After that I did another full scan, and it came up clean. I did another full scan this morning, just in case anything had regenerated when I rebooted, but all was clean, with no threats detected. I've done the same on the main computer.
I rang my contact in VM's CEO this morning and told him. He said he'd heard back from networks, and that the colleague who had told me in the first place I was a heavy downloader shouldn't have done, as my useage hadn't been flagged as too high. So it looks as if this whole fiasco has been for nothing.
Incidentally, if anyone ever needs the direct freephone for CEO it's Mod Edit - Unofficial number removed.
Thanks,
John.