Solved Internet Connection Being Continuously Spiked (Wireless or Wired)

[tmantrask]

Hello & thank you in advance for any help you can provide. Since Oct. 4th, I have had a internet connectivity issue. I noticed it while gaming as my connectivity was dropping during game saves. When I attempted to browse to other sites, my browser would time out (Firefox, IE, Chrome, didn't matter) & in the case of Firefox, even if I exited out of the browser, I would get an app crash box that also initially prevented my computer from shutting down (it would hang after exiting from the desktop). Prior to Oct. 4th, the only issue I would have periodically was a network adapter issue which Windows Troubleshooter would solve by resetting or worst case restarting the computer. I attributed this (rightly or wrongly) to the 7 to 8 year old wireless router I using. Please note that this issue doesn't affect my girlfriends 6 to 7 year old dell laptop nor does it affect our smartphones. The details on my system are as follows:

Operating System- Windows 7 Home Premium 64-bit SP1
Computer type: Dell XPS 8700 Desktop PC
CPU- Intel Core i5 4440 @ 3.10GHz Haswell 22nm Technology
RAM- 12.0GB Dual-Channel DDR3 @ 798MHz (11-11-11-28)
Motherboard- Dell Inc. 0KWVT8 (CPU 1)
Graphics- DELL P2314H (1920x1080@60Hz)
DELL P2314H (1920x1080@60Hz)
1023MB NVIDIA GeForce GT 635 (NVIDIA)
Storage- 931GB ATA ST1000DM003-1CH1 SCSI Disk Device (SATA)
465GB Western Digital WD 5000AAV External USB Device (USB (SATA))
931GB Western Digital WD My Passport 0820 USB Device (USB (SATA))
Optical Drives- HL-DT-ST DVD+-RW GHB0N SCSI CdRom Device
Audio- Realtek High Definition Audio
Wireless Adapter- Dell Wireless 1703 802.11b/g/n (2.4 GHz)
Wired Adpater- Realtek PCIe GBE Family Controller
Dell 460W power supply Model HU460AM-00

Here is a pic of the results of a power supply calculator with my setup:

Shared album - tman trask - Google Photos

Old Router- 2Wire 3800 HGV-B Residential gateway router
Current New Router- 2Wire 3801 HGV Residential gateway router (as of 10/11)
Internet Provider- AT&T Uverse 18mps down/3mps down

Connected devices in the home network: Dell Inspirion 1545 Laptop, Roku 2, Apple TV

For the last few weeks I have tried numerous things but with no resolution. I had been using a wireless connection but I did eventually run a 25 ft. ethernet cable from my PC directly into my old 2Wire router but with no benefit. I installed a new 2Wire router last month & again, no resolution to the problem. I should also mention that my connection in Safe Mode is unaffected which is why I'm able to post this. Before going through what steps I have taken to resolve this problem, below is a pic of the Network Utilization graph in Task Manager showing the spiking I'm talking about. This happens within 3 to 5 minutes after startup. Also note, this graph reflects what is happening after I have turned off all start up items & loaded minimal drivers.

http://img.auctiva.com/imgdata/8/3/6/6/1/0/webimg/91981...

Update: I noticed that the spiking in task manager is due to bytes received. So I turned on the Bytes received column in Networking. According to task manager, the spikes equate to approximately 18.5 trillion MB. The number is always the same 18,446,744,073,709 MB...

I have tried the following things over the last month including things suggested to other people in forums with somewhat similar issues including- resetting the TCIP/IP Stack, resetting Winsock, deleting wireless network adapters, disabling wireless adapters (once connected via a wired connection), deleting/reinstalling video adapter, switching from wireless to wired connection, changing to an updated router, running virus/malware scans with Malwarebyes/Spybot (including rootkit scan)/Norman (not Norton)/Microsoft Safety Scanner all with no issues being detected, a CCleaner pass, loading windows with no Startup items (Microsoft only drivers), ran a diagnostic in BIOS (everything passed), etc. I have also downloaded & run process explorer but have not been able to find something that stands out. All of the fans (including the PSU fan) were checked recently & work well. They are also quiet & debris free. The interior was cleaned in early September including all the fans.

I use Speccy to monitor temperature on my system. Below are clips showing various temps just after booting up & after 15 minutes or so of playing a video game.

Shared album - tman trask - Google Photos
Shared album - tman trask - Google Photos

Finally, at a friend's suggestion, I bought a USB 2.0 to Ethernet adapter to bypass my on board network adapters. It did not make a difference or resolve the issue.


Finally, below is the ipconfig/all file output:


Windows IP Configuration

Host Name . . . . . . . . . . . . : Colin-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : attlocal.net

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : attlocal.net
Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
Physical Address. . . . . . . . . : F8-B1-56-B3-7E-78
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2602:304:cfa2:49f0:9586:fb0e:5365:3b8b(Preferred)
Temporary IPv6 Address. . . . . . : 2602:304:cfa2:49f0:9461:5a6c:60ee:ce95(Preferred)
Link-local IPv6 Address . . . . . : fe80::9586:fb0e:5365:3b8b%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.110(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Tuesday, November 15, 2016 10:25:24 AM
Lease Expires . . . . . . . . . . : Wednesday, November 16, 2016 10:25:24 AM
Default Gateway . . . . . . . . . : fe80::bae6:25ff:fe2c:1239%11
192.168.1.254
DHCP Server . . . . . . . . . . . : 192.168.1.254
DNS Servers . . . . . . . . . . . : 8.8.8.8
8.8.4.4
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Windows Adapter V9
Physical Address. . . . . . . . . : 00-FF-32-AB-FF-E3
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 11:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft 6to4 Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.attlocal.net:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #5
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{32ABFFE3-AB93-4CF8-96CF-35CE6E7E1EA7}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #6
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{61FEDFE0-E970-4004-95D6-C0829E6CD9E1}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #7
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

 

[cyanna]

"Please note that this issue doesn't affect my girlfriends 6 to 7 year old dell laptop nor does it affect our smartphones." So the issue is with your computer, leave the router alone.
"my connection in Safe Mode is unaffected" So it's software related, leave the network adapter alone
Read THIS and perform the steps for Windows 7 clean boot. Reboot to check that the problem is gone. If it is, scroll down to where it explains how to figure out what caused the problem. If it didn't solve the problem post back.

 

[tmantrask]

I have done a clean boot several times prior to posting this & it did not resolve the issue.

 

[cyanna]

Assuming you have indeed disabled everything when doing the clean boot (in particular the Startup tab should be completely empty), this means the problem is with a Windows component (Safe boot= Clean boot + any non essential windows components).
1. In normal mode, download the executable from HERE and unzip then copy the small exe file somewhere.
2. In Safe mode, open a command prompt and type

tasklist >safetasks.txt

Check that a safetasks.txt file is created under your user profile.
3. click on the Sigma.exe and choose Information then driver infromation. The windwos can be resized to full screen but unfortunately the list can neither be sorted nor exported to a text, so you will have to use Print scr to take screen shots then paste them in Paint and save on the desktop. Name them something like safemode1, safemode2 and so on (takes me five screens)
4. Reboot in normal mode but perform a clean boot. Once again open command prompt and this time run

tasklist >cleantasks.txt

5. run the Sigma.exe again and keep the window open

Now to the hard part: you will need to compare the files generated in Safe mode with the ones generated in a clean boot. I would start with the Sigma.exe looking for running drivers and specifically the networkcard drivers. Is the driver name exactly the same in safe mode and Clean boot? If yes then you'll have to check the rest of the running drivers and running processes. If no replace the driver in clean boot with the one used in safe mode....

 

[tmantrask]

Thank you for the reply. I will download the items & follow your directions. I ended up redoing the clean boot & took clips of the various tabs in msconfig. After rebooting, I opened task manager & the networking tab. At 6 minutes after starting up in normal mode, the spikes started. I took clips of the graph at 6 minutes & 14 minutes. Below is a link to the clips:

111716 Clips & Graphs - Google Photos

 

[cyanna]

You have quite a few things still running in the clean boot screen shots.

 

[tmantrask]

Sorry about that. I have gone through & stopped the services that were running. Still had the same issue....

111816 Clips & Graph - Google Photos

 

[tmantrask]

I have followed your instructions & compared the Safe Mode drivers list to the Normal Mode drivers list line by line & they are exactly the same. However, there are some drivers that were running in Safe Mode but were stopped in Normal Mode. In addition, there are some drivers that were stopped in Safe mode but running in Normal Mode. Below is the complete list of Normal Mode drivers:

111916 Normal Mode Drivers List - Google Photos

The drivers that were running in Safe Mode but were stopped in Normal Mode are serial #s-

38, 56,
60, 61, 75, 85, 88, 92, 111, 112,
113, 114, 129, 132, 133, 158, 160, 161,
172, 192, 199, 200, 201, 202, 213, 214, 216, 219,
240, 241, 253, 257, 260, 262, 263, 265, 268

The drivers that were running in Normal Mode but were stopped in Safe Mode are serial #s-

58, 63, 94,
118, 123, 166, 167,
170, 190, 205, 207, 212, 217, 218,
235, 236, 237, 238, 244,
285, 294

If you prefer that I make a list of the driver name/description, let me know & I will redo this list.

 

[cyanna]

Sorry for the late reply, for some reason I didn't get the notification that you have posted. Looking through the driver list
- in normal mode you have hardware specific keyboard and mouse drivers, which do not explain the spikes
- you do have the norman general security driver running. I suggest you uninstall Norman security using an uninstaller such as Revo with the advanced tools
- what device do you use to connect to the internet?
- can you post the logs for the running tasks?

 

[tmantrask]

Thanks for the response & no worries. I connect to the Internet via a 2Wire 3801 HGV Residential gateway router. I'm currently using a wired connection. I uninstalled Norman & Malwarebytes using Revo. I did a clean boot but the issue still occurs 6 minutes or so after start up. Not sure how to generate the "running tasks" log but I will google it in the morning & try to run it/post it.

 

[cyanna]

Not sure how to generate the "running tasks" log but I will google it in the morning & try to run it/post it.

See post #4 above.

 

[tmantrask]

Below are the clips for safe mode:

112316 Safe Mode Drivers - Google Photos

and normal mode after clean boot:

112316 Normal Mode Drivers - Google Photos

 

[cyanna]

Are you getting anywhere in generating the log with the running tasks?

 

[tmantrask]

See post #12

 

[cyanna]

unless i have missed something, those are the drivers, not the running tasks.

 

[tmantrask]

Sorry, I guess i'm not quite understanding. Do you want me to generate a list from Task Manager (or i could use Process Explorer) of all running processes?

 

[tmantrask]

Hopefully this is the information you requested. If not, please advise further. Below are clips from process explorer.

This is just after start up in Normal Mode after clean boot::

112316 Normal Mode Process Explorer Just After Start Up - Google Photos

This is plus 6 minutes after start up in Normal Mode after clean boot:

112316 Process Explorer Normal Mode 6 Minutes after start up - Google Photos

This is a process explorer summary graph 6 to 8 minutes after startup in Normal Mode after clean boot:

112316 Process Explorer Summary Graph - Google Photos

Thanks again for your continued help!

 

[cyanna]

Boot in Safe mode. Wait your usual ten minutes or so then open a command prompt and type

tasklist >safetasks.txt

then press enter

Check that a safetasks.txt filehas been created under your user profile. (C:\Users\yourusername)

Reboot in normal mode but perform a clean boot. Once again wait until the spikes appear then open command prompt and this time type

tasklist >cleantasks.txt

tjhen press enter

Post back with both txt files. Please attach the files not a link to pictures.

 

[tmantrask]

Thanks for the patience. Here is the safetasks list:


Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 24 K
System 4 Services 0 3,992 K
smss.exe 308 Services 0 1,244 K
csrss.exe 440 Services 0 3,896 K
csrss.exe 476 Console 1 5,896 K
wininit.exe 484 Services 0 4,788 K
winlogon.exe 512 Console 1 5,752 K
services.exe 576 Services 0 7,664 K
lsass.exe 584 Services 0 10,552 K
lsm.exe 592 Services 0 4,476 K
svchost.exe 692 Services 0 9,456 K
svchost.exe 768 Services 0 7,592 K
svchost.exe 864 Services 0 11,180 K
svchost.exe 896 Services 0 17,472 K
svchost.exe 956 Services 0 7,580 K
svchost.exe 984 Services 0 14,876 K
svchost.exe 436 Services 0 14,004 K
svchost.exe 684 Services 0 11,084 K
svchost.exe 1344 Services 0 5,972 K
explorer.exe 1488 Console 1 95,952 K
ctfmon.exe 1552 Console 1 3,796 K
dllhost.exe 1812 Console 1 9,160 K
svchost.exe 1644 Services 0 19,228 K
cmd.exe 2020 Console 1 3,240 K
conhost.exe 1592 Console 1 4,372 K
tasklist.exe 1648 Console 1 6,260 K
WmiPrvSE.exe 1952 Services 0 6,816 K


& here is the cleantasks list:


Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 24 K
System 4 Services 0 4,000 K
smss.exe 364 Services 0 1,304 K
csrss.exe 620 Services 0 4,836 K
csrss.exe 712 Console 1 8,068 K
wininit.exe 720 Services 0 4,948 K
winlogon.exe 768 Console 1 8,032 K
services.exe 820 Services 0 9,668 K
lsass.exe 828 Services 0 14,628 K
lsm.exe 836 Services 0 4,584 K
svchost.exe 944 Services 0 10,116 K
svchost.exe 200 Services 0 8,204 K
svchost.exe 708 Services 0 24,632 K
svchost.exe 896 Services 0 20,072 K
svchost.exe 1036 Services 0 17,976 K
svchost.exe 1064 Services 0 34,500 K
svchost.exe 1180 Services 0 5,992 K
svchost.exe 1292 Services 0 16,500 K
spoolsv.exe 1560 Services 0 17,940 K
svchost.exe 1612 Services 0 14,528 K
svchost.exe 1712 Services 0 11,956 K
PnkBstrA.exe 1844 Services 0 4,424 K
svchost.exe 1904 Services 0 10,384 K
svchost.exe 1928 Services 0 5,972 K
WLIDSVC.EXE 1976 Services 0 15,392 K
SearchIndexer.exe 2036 Services 0 26,408 K
WLIDSVCM.EXE 1536 Services 0 3,928 K
svchost.exe 2356 Services 0 5,256 K
svchost.exe 2556 Services 0 5,988 K
WUDFHost.exe 2728 Services 0 6,808 K
taskhost.exe 2920 Console 1 12,208 K
taskeng.exe 2964 Console 1 7,092 K
dwm.exe 2080 Console 1 31,548 K
procexp.exe 2172 Console 1 7,704 K
taskeng.exe 1740 Console 1 7,636 K
ipoint.exe 2824 Console 1 12,612 K
explorer.exe 2844 Console 1 94,512 K
itype.exe 2876 Console 1 12,624 K
svchost.exe 3800 Services 0 7,624 K
PROCEXP64.exe 3996 Console 1 13,864 K
WmiPrvSE.exe 3472 Services 0 7,576 K
svchost.exe 2544 Services 0 28,988 K
WmiPrvSE.exe 3896 Services 0 6,384 K
rundll32.exe 492 Services 0 3,648 K
audiodg.exe 1208 Services 0 19,512 K
cmd.exe 500 Console 1 3,204 K
conhost.exe 3516 Console 1 5,892 K
tasklist.exe 2808 Console 1 6,320 K
WmiPrvSE.exe 1516 Services 0 6,884 K

 

[cyanna]

pnkbstra.exe is an anticheat for online games. Google wisdoms suggests the following steps to stop it from running
Step 1

Close any currently running games that use PunkBuster. Open the Windows Task Manager by pressing "Ctrl, "Alt" and "Delete" together. Click the "Processes" tab. Scroll down and click "Pnkbstra.exe." Click "End Process" to stop this program from running.
Step 2

Click "My Computer" on the desktop and double click the "C:" drive. Double click "Users" and double click "Appdata."
Step 3

Click Local > Punkbuster > WAW > Pb. Right click "Pnkbstra.exe" and click "Compatibility." Place a check on "Run this program as an administrator" and click "OK" to save the changes. This action will bring the program to the Services window.
Step 4

Click the Windows Start > Run. Type "services" (without quotes) and press "Enter" to open the Services window. Scroll down the Services window and double click "PnkBstra" or "PunkBuster." Click "Disabled" on the "Startup-type" window and click "OK" to save changes. Punkbuster will be removed from start up and will no longer run.


Check the network spikes and see if this has helped any.


The next suspect in line is Windows Live ID: WLIDSVC.EXE and WLIDSVCM.EXE. Find the corresponding service and disable it. Check the spikes and if they are still there please generate a new cleantasks.txt log, as usual from a clean boot.