Help! Data constantly downloading...

Nokkie · Jul 31, 2006

vodacom3g said:
1) "You have used your monthly data bundle": You bought some data bundle and have now used it up, say you bought a 50M bundle, this is now depleted.

2) "and can continue at the out of bundle rate"; you can carry on using data but will now be charged @ R2/Mb.

3) "This information can be up to 3 hours old, from last disconnect": THe billing systems normally update only every 3 hours, so you could have gone over your bundle 3 hours ago.

but i cAN' see that it is possible becuase i bout a 500mb package what is that for then?

Geeves · Jul 31, 2006

vodacom3g said:
Obviously something is downloading or sending data, this could be malware of some kind or it could just be updates including the virus definition files themselves!

Download and install netlimiter or netmonitor (http://www.netlimiter.com) to see which apps are using how much data.

Hmmm...i THINK that I might have ID'ed the data eating culprit as a file called C:\windows\system32\svchost.exe. Did a google search on it and it can apparently either be a legitimate windows file (something to do with DLL?) or a host of other 'bad' stuff parading as a legit file...Anyways, any futher ideas would be appreciate because in a short 10-minutes you guys have already put me on the right track! I think...

G

Nokkie · Jul 31, 2006

V3G Can you please pm me your number so that i can speak to you over the phone? thanks...

Piesang · Jul 31, 2006

I have the same problem when I use my Vodacom Sim with HSDPA. 98% of the time I'm only on MYADSL, GMAIL and other forums. Not images and stuff and my data usage is much more with HSDPA than when I use my MTN EDGE or Virgin Mobile EDGE.

vodacom3g · Jul 31, 2006

Geeves said:
Hmmm...i THINK that I might have ID'ed the data eating culprit as a file called C:\windows\system32\svchost.exe. Did a google search on it and it can apparently either be a legitimate windows file (something to do with DLL?) or a host of other 'bad' stuff parading as a legit file...Anyways, any futher ideas would be appreciate because in a short 10-minutes you guys have already put me on the right track! I think...
G

How did you find it was svchost?

If you use netmonitor, you should be able to see the process that doing it and the site it is connecting to.

vodacom3g · Jul 31, 2006

Piesang said:
I have the same problem when I use my Vodacom Sim with HSDPA. 98% of the time I'm only on MYADSL, GMAIL and other forums. Not images and stuff and my data usage is much more with HSDPA than when I use my MTN EDGE or Virgin Mobile EDGE.

You're probably seeing the effect of the connetion speed. If you're online for x amount of time, with HSDPA you have a much bigger data window than with EDGE, probably around a factor of 5 to 10.

Again, watch it with something like netlimiter.

Deiphos · Jul 31, 2006

vodacom3g said:
You're probably seeing the effect of the connetion speed. If you're online for x amount of time, with HSDPA you have a much bigger data window than with EDGE, probably around a factor of 5 to 10.

Again, watch it with something like netlimiter.

Yup, like the widely used tollgate analogy used in schools to describe bandwidth in busses, internet etc...

For example, a tollgate with 2 gates, which can handle 1 car per minute per gate, can handle 2 cars per minute. So every minute you have 2 cars moving through the tollgate.
A tollgate with 10 gates, handling 1 car per min, can push through 10 cars per minute.

Same with bandwidth, the faster the connection, the faster data moves to your PC, and the less you realise how much data is going through your connection.

Geeves · Jul 31, 2006

vodacom3g said:
How did you find it was svchost?

If you use netmonitor, you should be able to see the process that doing it and the site it is connecting to.

Through netlimiter netmonitor as per your suggestion...it being the only "application" starting and continuing to use data the moment I connect via datacard. To be honest...not quite sure how to go about determining what site it is connecting to (only downloaded the free version, so maybe that functionality is for the paid-for version)?

Geeves · Jul 31, 2006

ic said:
@Geeves, svchost.exe is an essential Micro$oft file [part of the operating system as such], but it can be used by malware to load a malware DLL and emulate running it as a service, which just means that you need to use a few different anti-spyware packages to scan your machine and remove the malware.

Start with http://www.safer-networking.org/en/download/ SpyBot Search & Destroy, then try http://www.Lavasoft.de - AdAware free version
also, if you don't have anti-virus installed, try http://free.grisoft.com/ AVG Free Edition, also http://www.microsoft.com/athome/security/spyware/software/default.mspx Windows Defender (Beta 2).

Run full system scans with each of those - make sure you are using the latest definitions for each of them.

Thanks - have good anti-virus software and already downloaded Adaware. So what you are saying try Spybot AND microsoft too? Also, if svchost is legit, is there any way of switching if off without any negative effects (seeing that i am not really sure what it does

?

vodacom3g · Jul 31, 2006

Geeves said:
Through netlimiter netmonitor as per your suggestion...it being the only "application" starting and continuing to use data the moment I connect via datacard. To be honest...not quite sure how to go about determining what site it is connecting to (only downloaded the free version, so maybe that functionality is for the paid-for version)?

If you click on the plus sign to the left of the svchost entry, you'll get a dropdown list of all the processes. One of them will be the one generating the traffic. If you click on it, you should see the IP it is connecting to.

You can then do a nslookup on this IP and see which site it is.

If this is getting a bit hairy, time to call in a favour from a PC-savvy techie friend

adsl3g · Jul 31, 2006

Geeves said:
Hmmm...i THINK that I might have ID'ed the data eating culprit as a file called C:\windows\system32\svchost.exe. Did a google search on it and it can apparently either be a legitimate windows file (something to do with DLL?) or a host of other 'bad' stuff parading as a legit file...Anyways, any futher ideas would be appreciate because in a short 10-minutes you guys have already put me on the right track! I think...
G

@Geeves - I had the same problem with the E620 card dashboard from 'another provider'. If you click on the 'windows network connected' icon in the sys tray, what does it show. Is the data being transferred at the same rate as reported by the dashboard. In my case the dashboard was doing exactly as in your case but the windows network icon did not show it. In actual fact I put it down to all lan traffic being reported by the dashboard and not just internet traffic.
The data transferred reported by the windows icon balanced with my data usage on the V4me site.
Just test it and advise.

Deiphos · Jul 31, 2006

Geeves said:
Thanks - have good anti-virus software and already downloaded Adaware. So what you are saying try Spybot AND microsoft too? Also, if svchost is legit, is there any way of switching if off without any negative effects (seeing that i am not really sure what it does ?

It is always good to have a few different anti-spyware programs. Remember that each program uses different methods when scanning your PC for malware, each have different lists of malware, so using many different utilities will help keep your PC clean.

svchost is a Local Service on your machine, it isn't always wise to simply end the process. The best option I have seen is to have a look in your registry and see which programs are being loaded upon system boot. As far as I know this is located in the "HKEY_LOCAL_MACHINE/SOFTWARE/WINDOWS/CurrentVersion/Run/" key. Use Start->Run regedit to get there.

Geeves · Jul 31, 2006

vodacom3g said:
If you click on the plus sign to the left of the svchost entry, you'll get a dropdown list of all the processes. One of them will be the one generating the traffic. If you click on it, you should see the IP it is connecting to.

You can then do a nslookup on this IP and see which site it is.

If this is getting a bit hairy, time to call in a favour from a PC-savvy techie friend

Tee hee! Got ya! I understand what you are saying and found the address, but alas the nslookup process starts to look a bit 'hairy'...i think it might be time for a techie friend! Thank you!

Hmmm...just had a thought...seeing that the datacard contains a simcard that can receive sms's and it continously look for incoming sms's...isn't it possible that it might be that?

Nokkie · Jul 31, 2006

Veg is it possible that when i bought my card this past saterday that they havn't gave me my full bundle since it was almost near the end of the month?

do you loose downloading speed when you switch to out of bundle rate?

ps since i called you i waited 18min on the line 155 for them to pick up

it also seems that my card keeps on disconnecting now for some odd reason?

tia

vodacom3g · Jul 31, 2006

Geeves said:
Tee hee! Got ya! I understand what you are saying and found the address, but alas the nslookup process starts to look a bit 'hairy'...i think it might be time for a techie friend! Thank you!

Hmmm...just had a thought...seeing that the datacard contains a simcard that can receive sms's and it continously look for incoming sms's...isn't it possible that it might be that?

No SMS's don't use your data connection, so it's not that.

Geeves · Jul 31, 2006

adsl3g said:
@Geeves - I had the same problem with the E620 card dashboard from 'another provider'. If you click on the 'windows network connected' icon in the sys tray, what does it show. Is the data being transferred at the same rate as reported by the dashboard. In my case the dashboard was doing exactly as in your case but the windows network icon did not show it. In actual fact I put it down to all lan traffic being reported by the dashboard and not just internet traffic.
The data transferred reported by the windows icon balanced with my data usage on the V4me site.
Just test it and advise.

Nope...not that...have no access to lan or any other network at home and the dashboard count roughly tallies with network icon counter. Thanks for thought though!

flenters · Jul 31, 2006

What you can try is the following :
Close all your open apps.
Make the connection
start - run - cmd
netstat -A
this should display all active connections.
If you have an established connection try ping the ip addy with -a to see the hostname you are connecting to.

Nokkie · Jul 31, 2006

say what?

debug · Jul 31, 2006

I also tested and saw this weird data usage on MTN (via D500) and Vodacom (via E620) a long time ago with same result. Lots of data usage by M$ Winsock while I'm doing absolutely nothing. It resolves connections to us m$ servers. But when u terminate (With TCPView) it ur connecton gets frozen. Must say on voda via E620 have not picked it up again. (After disabling all auto-updates + xp firewal)

Also picked up that the XP firewall also sometimes uses alot of data.

debug

MyDraadloos · Jul 31, 2006

More is better

When it comes to AV and Anti-Spyware I have found that more is better, but beware some tools are actually Spyware themselves or will hold you ransom for a fix.

AVG has been bullit proof on my system for a long time, Norton and Symantec can go suck eggs ( resource hungry and weak )

----Anti-Spyware
Spyware Guard
Spyware Blaster ( These first two insure that you don't do something stupid that will damage your system)
Ewido (scanners )
Spybot Search & Destroy
Ad-Aware SE

Help! Data constantly downloading...

Executive Member

Member

Executive Member

Executive Member

Vodacom Representative

Vodacom Representative

Well-Known Member

Member

Member

Vodacom Representative

Expert Member

Well-Known Member

Member

Executive Member

Vodacom Representative

Member

Well-Known Member

Executive Member

Well-Known Member

Expert Member