dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
8026
share rss forum feed


sara3623

@wildblue.net

[WildBlue] Upload usage is ridiculously high - how can I stop th

I've had Exede for two weeks, and my upload usage is at 20.2 GB as of this AM. I only discovered the high rate a few days ago, and since then have disconnectd every wireless device except one laptop, have changed my wireless and router passwords, and have used the laptop for only email and light web browsing. I have not upload any pictures, movies, etc, and yet the upload usage is still climbing. I've run spyware checks, malware, anti virus, etc. Wildblue tells me "sorry, it is what it is."

Any suggestions for how to find out what is causing this absurd upload rate and stop it?!?



stinkyboots

@wildblue.net

Re: [WildBlue] Upload usage is ridiculously high - how can I sto

Have you used Malwarebytes specifically to scan (there are others as well)? Do you have any automatic backup software installed (Dropbox, Mozy, etc.)? Otherwise maybe someone with access to your computer may have some filesharing software running. There is software to monitor what is going out of your computer, but we'll start with these questions.


silbaco
Premium
join:2009-08-03
USA
reply to sara3623

Use Spotify? That can eat up data caps like no other.



sara3623

@wildblue.net
reply to stinkyboots

Yes, I used Malwarebytes, in fact I used it on all 3 computers. I have no online backup (I use an external). It's just me and my husband, and we are both perplexed as to what is causing this -- no filesharing software.



sara3623

@wildblue.net
reply to silbaco

No music programs, no video sharing, no uploading of pics. No webcam use in the last two weeks (since we moved in here).


DrStrangLov

join:2012-03-28
reply to sara3623

said by sara3623 :

I've had Exede for two weeks,
sara3623@wildblue.net

Do you have both Wildblue and Exede?


sara3623

@wildblue.net

No, just exede. The forum added @wildblue.net to my name.


W5JGV

join:2001-02-03
Natchitoches, LA
Reviews:
·WildBlue
reply to sara3623

Install NETMETER (free) on all three machines. It will not tell you what program is uploading data, but it will tell you which machine is the culprit.

»www.metal-machine.de/readerror/i···l=item23

Ralph W5JGV - WD2XSH/7


sara3623

join:2012-08-07
Rosamond, CA

I did install netmeter, but since I'm using only one computer right now (trying to eliminate all variables by disconnecting all other deveices) it isn't very useful info.

Are there program out there that can tell me WHAT I am uploading, or at least which programs are uploading? I googled and found a few, but I'm not familiar with those types of programs and want to make sure I'm using something reputable.

Thanks!


AlmontJohn

join:2011-01-27

Try TCPview. It's a Sysinternals (now Microsoft) utility.

»technet.microsoft.com/en-us/sysi···437.aspx


xexx

join:2004-09-03
Aledo, TX
Reviews:
·Skybeam.net
reply to sara3623

You can also try NetLimiter »www.netlimiter.com/ , it'll show you what process is using what bandwidth, the pro version is pretty powerful but the free version should do what you're wanting to do. I think there's a trial for the pro as well.



stinkyboots

@wildblue.net
reply to sara3623

Maybe give Hitman Pro a quick try if the programs mentioned don't turn up anything obvious, could be something hidden, it's caught a few things on a few different machines for me that others missed. It usually scans very quickly.
»www.surfright.nl/en/downloads


sara3623

join:2012-08-07
Rosamond, CA
reply to xexx

I've installed Netlimiter and found the chart sowing my rate of up and download -- can I also determine which programs are doing the up/down?

I'll keep digging around the program, but if anyone knows where to find that info, I would appreciate it!!


sara3623

join:2012-08-07
Rosamond, CA

I found Bitmeter OS, and it seems to do a great job of letting you know how much you are up/down loading - easy to read graphs for non-techies like me. Doesn't show where it comes from, but good to have to compare to what wildblue is telling me!


sara3623

join:2012-08-07
Rosamond, CA
reply to sara3623

I found Bitmeter OS, and it seems to do a great job of letting you know how much you are up/down loading - easy to read graphs for non-techies like me. Doesn't show where it comes from, but good to have to compare to what wildblue is telling me!


Spice300
Premium
join:2006-01-10

2 edits
reply to sara3623

Whereas malware is a possible explanation for unaccounted upload, the most likely cause is point-to-point (P2P) software installed on one or more of your computers in your network. Some P2P software may have been loaded onto one or more of your computers without your knowledge.

If you are using Windows, then you can use Task Manager under the "Applications" or "Processes" tabs to see which programs and processes are active. Right click on a blank area of the TaskBar and execute Task Manager from the popup menu.
--
Wildblue Value Pack, beam 31, Riverside gateway


sara3623

join:2012-08-07
Rosamond, CA

Applications are as expected, processes include the typical list of 30+ that I usually see in the task manager. Can you give me some suggestion as to what to look for to find a P2P program that I might be unaware of? Are there typical ones I can look for?



stinkyboots

@wildblue.net

P2P programs are the file sharing programs previously mentioned. Here's a list, maybe just check in add/remove programs and look for anything suspicious. »en.wikipedia.org/wiki/Comparison···ications


Spice300
Premium
join:2006-01-10

1 edit
reply to sara3623

To locate the offending program under the processes tab, look in the CPU, I/O Read and I/O Write columns for which tasks are active when your computers should be idle. If these columns are not displayed, then left click on the "View" pull down menu and select "Select Columns..." to see a list of columns that you can enable. Put a check mark in the appropriate boxes and left click "OK." Move the mouse cursor to the edge of the Task Manager Window until a double arrow appears and then resize the window so you can see the information in all of the columns.

I think your best course of action is to attach each computer to the Internet one at a time until you identify which computer is uploading the data. You can use the bandwidth monitors other posters mentioned to monitor them. After you have identified the offending computer or computers, use Task Manager to locate the program. The program might not load and run until you attach the computer to the Internet.

Did a guest use one of your computers around the time the problem appeared? Some of the file sharing sites automatically load the software onto your computer when someone downloads a file.
--
Wildblue Value Pack, beam 31, Riverside gateway


sara3623

join:2012-08-07
Rosamond, CA

Spice300 -- I checked for the P2Ps listed on Wikipedia, none were on my system. No one uses my laptop except me, and I can't think of a guest who has used my desktop.

I see expected CPU usage in Task Manager when the computer is idle. I added to I/O Read and Write, and also added I/O Read/Write bytes. Do the "write bytes" represent data that is currently being written, ie, uploaded? If so, then there are no unexpected lines, and Chrome is the largest at 169,137,945.

Thank you so much for all the help -- I seriously need to figure this out!! I'm beginning to think that Exede is simply reading my uploads wrong, because I am tracking my usage data hourly with them, any they say I have up0load 200 MB today, while bitmeter says I have uploaded 56MB.


xexx

join:2004-09-03
Aledo, TX
Reviews:
·Skybeam.net
reply to sara3623

said by sara3623:

I've installed Netlimiter and found the chart sowing my rate of up and download -- can I also determine which programs are doing the up/down?

Netlimiter should show you in real time what programs are downloading or uploading, and let you set any limits you want - though you may need to pro trial to do that.

Spice300
Premium
join:2006-01-10
reply to sara3623

"Write bytes" is the amount of data that has been written in write operations initiated by the process since it began running. It can be sent to many places including the network adapter for uploading or to your computer display.

What do the Task Manager memory columns mean?

For comparison my Firefox browser running under Windows 7 is showing:

I/O Read bytes: 20,514,959
I/O Write bytes: 50,919.014
Netstat Received bytes: 342603356
Netstat Sent bytes: 21014563
NetWorx received: 249 MB
NetWorx sent: 15.9 MB

This data is normal for browsing or downloading on a single computer connected to a Wildblue modem. The data reported by Networx is the amount of data received and sent on my Internet since I last started my computer.

Is your laptop computer connected directly to your Exede modem through an Ethernet cable?

Or is your laptop computer connected to your router (by cable or wireless?) and your router connected to your Exede modem by Ethernet cable?

I thought the amount of uploaded and downloaded data on Exede's DAP meter is combined into a single number. If they are separate, how much data does your Exede DAP meter indicate for download?
--
Wildblue Value Pack, beam 31, Riverside gateway


Spice300
Premium
join:2006-01-10
reply to sara3623

said by sara3623:

Chrome is the largest at 169,137,945.

I am tracking my usage data hourly with them, any they say I have up0load 200 MB today

bitmeter says I have uploaded 56MB.

What does bitmeter report for your separate upload and download usage?
--
Wildblue Value Pack, beam 31, Riverside gateway

aegrotatio

join:2012-08-11
Oakton, VA
reply to sara3623

Recently, I would have said that they are wrong and you are right, but now I realize that malware really does cause high upload usage. Not only that, but even the best, modern malware detector software is not able to detect the latest threats. The upload consists of thousands of emails being sent to hundreds of thousands of victims throughout the internet. The malware is controlled by spam botnets which instruct your computer to spam the world without you even knowing what is going on.

Best thing you can do is get the malware detectors and also get something called Spybot Search and Destroy. It uses clever tricks to fool the malware.

The other thing to check is that your wireless and router passwords are not guessable. Make them two different 14-character words and write them down. Your wireless and/or router should be able to tell you your upload usage as well.

Also, make sure your email account a 14-character word, too, because the one thing that most of the botnet malware does is to use your email account to send the spam (and delete it from your "Sent" folders) so you won't even know it's happening.


zeddlar

join:2007-04-09
Jay, OK
Reviews:
·exede by ViaSat
·McDonald County ..
reply to sara3623

I agree with aegrotatio, I got a keylogger program (a program that records each of your keystrokes and sends it to the person that initiated the program) from a link on Facebook once and unknown to me it had hijacked the password to one of my email adress's and the password to one of my accounts on a game the next day. Luckily those were the only 2 passwords I had typed before the game I played told me a wrong IP address had tryed to access my account.

I checked the usage meter on Hughesnet and sure enough, my usage had skyrocketed so I changed the password on the email address I had been to and the game account and the usage immediatly stopped. I then ran every program I could find and never caught the actual keylogger program and eventually wound up dumping windows, reformatting my hard drive and reinstalling windows to get rid of it.

There are some powerfull antivirus and malware programs out there but once in a while there is a program that just slips under the radar or is written so you can't install anything to get rid of it period and in these cases the the only answer is the extreme one and thats to reload windows. I hope you don't have to go this far. If you do, make double certain you havn't used your backup since this usage started happening before using it to restore your files after you reinstall windows or you could be right back to square one. Kapersky, spybot search and destroy, adaware and malwarebytes are probably the most effective malware and virus scanners out there and if they don't find anything then you are probably doomed to a format and reinstall. I wish you luck.
--
HughesNet elite plan/.74 dish w/1watt trans. / 9000 modem / 3 computers on a linksy's wired network



stinkyboots

@wildblue.net
reply to sara3623

Spybot is still pretty good.

Exede's meter has a history of being off, just because they say it's fixed doesn't mean it's fixed for everyone everywhere. With the rollout and customer service being what it is, I'd say that it's a possible culprit. But as I said before, something hidden is possible as well. Combofix is another tool that works well, but it's one of the last resorts. It's worked often for me in the neighborhood, but I've seen a system become unusable after it's use, depending what it is.

Before doing anything drastic, if there was any way you could get by with a known clean system, or possibly run a Linux livecd or liveusb, you could watch the usage and know whether or not it is one of your systems. If you have a router, I would disconnect it for now, even if you are changing passwords on it, and use only a direct cable for testing purposes.

About 6 years ago one of my neighbors had a similar problem on dialup, the only thing is I found and fixed it (don't remember which I used or what it was). Every time the computer was idle, it was emailing out copies of itself. This went on for a few weeks, and they didn't notice it was going on. They said the internet was a little slow, but when they used the phone, it would disconnect right away, etc. I figured up data usage with all the attachments (the sent messages were saved), it was over 2GB.


darrick04

join:2011-07-30
Shelbyville, TN
reply to sara3623

Just wondering if you have any of your broadband connected to a satellite tv system, such as DirecTVs whole home dvr system? I know, once upon a time, when we used to have the old WildBlue, we got DirecTV and the installer connected the DECA to our internet connection and our usage tripled... we didn't even need that.

Otherwise, sounds like a software bug is draining your bandwidth.


sara3623

join:2012-08-07
Rosamond, CA

No internet attached to the TV -- the tech gave us the USB adapter and it is not currently installed.

After monitoring my usage through Bitmeter for the last week, it appears as though whenever my computer is on, it is constantly uploading a small amount -- 945 kb an hour, 750 kb an hour, 1045 kb an hour, and so on for any time my computer is tuned on. Even in sleep mode, it is still uploading small amount each hour.

That's not much, but since it is constant, it adds up to ~20MB a day uploading when nothing is happening. That doesn't explain all of my high uploading, but it certainly accounts for some of it -- and it's just disconcerting to see.

I've run every spyware and malware I can find, including every one that was recommended in the previous posts. I also had a friend plus her laptop directly into my router, and after installing bitmeter I saw that she too was uploading data constantly -- so it's not just my laptop.

I've been told that this is typical, and that programs often upload bits of data regularly, and Windows is always taking data. Does ~20MB a day of uploading when the computer is NOT active sound reasonable, or could this be the root of my issue?

Thanks,
Sara