Solved Internet Connection Being Continuously Spiked (Wireless or Wired)

[tmantrask]

I actually found PnkBstr in C:\Windows\SysWOW64 and there were 2 instances of it. PnkBstrA.exe & PnkBstrB.exe. One was installed in 2014 & the other in June of 2016. Both are associated with the game Far Cry 3. I probably played the game in June of this year after not having played it for over a year. I'm assuming that the original PnkBstrA version was outdated so it installed an updated version. I applied "run as administrator" to both versions. When I went to services, only PnkBstrA appeared. I disabled this & did a clean reboot but the spiking began after 6 minutes.

Repeated the same instructions for WLIDSVC.EXE and WLIDSVCM.EXE but the spiking still persists. Below is the updated cleantasks list.

One weird thing I did notice, though it may not have anything to do with anything, was that after clean booting one time, the Dell Support Assist Agent icon momentarily flashed on/off on my desktop toolbar even through the service is stopped & disabled.


Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 24 K
System 4 Services 0 4,036 K
smss.exe 364 Services 0 1,280 K
csrss.exe 620 Services 0 4,444 K
csrss.exe 712 Console 1 7,980 K
wininit.exe 720 Services 0 4,968 K
winlogon.exe 768 Console 1 8,228 K
services.exe 820 Services 0 9,620 K
lsass.exe 828 Services 0 12,436 K
lsm.exe 836 Services 0 4,520 K
svchost.exe 936 Services 0 10,084 K
svchost.exe 1016 Services 0 8,096 K
svchost.exe 624 Services 0 24,792 K
svchost.exe 920 Services 0 20,016 K
svchost.exe 1028 Services 0 18,032 K
svchost.exe 1056 Services 0 34,176 K
svchost.exe 1168 Services 0 5,792 K
svchost.exe 1280 Services 0 16,456 K
spoolsv.exe 1528 Services 0 17,388 K
svchost.exe 1608 Services 0 14,520 K
svchost.exe 1708 Services 0 11,952 K
svchost.exe 1844 Services 0 10,356 K
svchost.exe 1868 Services 0 6,060 K
SearchIndexer.exe 1900 Services 0 62,552 K
SearchProtocolHost.exe 2168 Services 0 12,164 K
svchost.exe 2260 Services 0 5,284 K
svchost.exe 2532 Services 0 5,968 K
WUDFHost.exe 2620 Services 0 6,824 K
taskhost.exe 2772 Console 1 12,396 K
taskeng.exe 2832 Console 1 7,056 K
dwm.exe 2932 Console 1 32,096 K
taskeng.exe 2956 Console 1 7,680 K
procexp.exe 2992 Console 1 7,672 K
explorer.exe 3004 Console 1 97,652 K
ipoint.exe 3012 Console 1 12,608 K
itype.exe 3028 Console 1 12,640 K
svchost.exe 3424 Services 0 7,604 K
PROCEXP64.exe 3516 Console 1 14,068 K
WmiPrvSE.exe 3792 Services 0 6,968 K
taskmgr.exe 3448 Console 1 13,248 K
svchost.exe 3624 Services 0 30,032 K
WmiPrvSE.exe 2888 Services 0 6,384 K
audiodg.exe 3644 Services 0 20,976 K
cmd.exe 3844 Console 1 3,132 K
conhost.exe 2132 Console 1 5,912 K
SearchFilterHost.exe 2112 Services 0 5,764 K
tasklist.exe 3344 Console 1 6,408 K
WmiPrvSE.exe 3088 Services 0 6,936 K

 

[cyanna]

Can you please download and instal Proces Hacker
Start it immediately after a clean boot and click on the network tab (in the Proces Hacker window). Click on the column labelled state to order the list by the state of the connection. When the spikes start any new entries will be momentarily shown in green. You won't have much time before they are white again so try and keep an eye out for the name of the process. The entries will then remain in the list as slong as the process is using the network card even if its just listening.
Post back with which processes are connecting when the spikes appear.

 

[tmantrask]

Unfortunately nothing consistently matched up with the spikes. I clean booted 4 times & ran process hacker for 10 to 15 minutes each time. The only other things I had open were task manager, to monitor the spiking, and notepad. The following started up either prior to the spiking or after the spiking started:

Prior to spiking:
Waiting Connections attlocal.net Local Port: 49163 Remote Address: 2600:1417:4::b833:72fb Remote Port: 80
Waiting Connections Local Port: 5357 Remote Port: 49165
svchost.exe (1292) Local Port: 49165 Remote address- 2600:1417:4::b833:7313 Remote Port: 80
svchost.exe (1292) Local Port: 49164 Remote address- 2001:668:108:c083::b1f Remote Port: 80

During Spiking:
GWXConfigmanager.exe
svchost.exe (1284)
svchost.exe (1700) Remote Address 64.4.54.254
svchost.exe (1268)
svchost.exe (1684) Remote Address 64.4.54.254 Remote Port 443
svchost.exe (1708) Local Port: 49170 Remote Address 64.4.54.254 Remote port: 443 Owner: DiagTrack
Waiting Connections Local Port: 5357 Remote Port: 49173

None of them occurred more than one or two times in totality. Most of the time the Network tab looked like this:

Shared album - tman trask - Google Photos

I happened to open the system related graphs in Process Hacker & noticed a periodic spike on the i/o graph due to SearchProtocolHost.exe & was similar to this:

Shared album - tman trask - Google Photos

 

[cyanna]

In task manager click on the performance tab then at the bottom of that window click on Resource Monitor. In the new window click on Network. Post a screen shot.

 

[tmantrask]

Here are several starting with just after start up through about 15 minutes:

112616 TM Resource Monitor - Google Photos

 

[cyanna]

according to that picture the spikes are not an internet connection but something on your local network. Can you switch off any networked devices? If it helps switch them back on one by one to find the culprit.
Otherwise try and tick the box for one of the processes in the top pane of the list, you should get an oragne line with what part of the network resource that process is consumming. Go through them until you find what is creating the spikes. When you have found at least one, expand the lists under the top pane to get some details about the network activitiy and the listning ports.

 

[tmantrask]

After my last reply, I had thought of this. I disconnected all the network devices- Roku player, AppleTV, smartphones, laptop, & TV. The spiking continued. I even unplugged my refrigerator & microwave to see if that had any affect. Spiking still continued. I will upload a link to screen shots of the resource monitor that show what you requested.

 

[tmantrask]

Here are some examples:

112616 Ticked Items in TM Resource Monitor - Google Photos

 

[cyanna]

sorry, once again i did not get an email that you have posted...Go to services and look for SSDP discovery and disable the process. Did that help?

 

[tmantrask]

No problem. I will do that tonight when I get home from work and will post back.

 

[tmantrask]

I disabled SSDP Discovery & UPnP Device Host but the spiking continues like clockwork 6 minutes after start up....

 

[cyanna]

I have to give up. Unless you manually go through every single difference between Safe mode and Clean boot I don't see how you will be able to figure this out.

 

[tmantrask]

Ok thanks for all your help & time. Do you think reinstalling Win 7 might take care of the problem?

 

[cyanna]

1. Is it a problem? I mean I know the spikes are there but do they actually casue any problems?
2. Is there any way to chack if another computer experiences the same problem?

 

[tmantrask]

Thanks for the response. The spiking interrupts my internet connection. I can't play videos, stream audio, download files in a timely manner, or play some of video games. For example, I downloaded a razer update last night in normal mode & normally it might take a minute or two but it took about 30 minutes. I have checked for this issue on my girlfriends laptop & she does not have this issue at all. Also, I took a clip of vertical line spiking I noticed appearing on my resource monitor last night after running it for 30+ minutes. This was not after a clean boot though. I did clean boot after this but this type of spiking did not reappear:

Shared album - tman trask - Google Photos

 

[cyanna]

according to that image you have three 'live' connections: apple doing whatever it's doing, Galaxy which is your games platform and interestingly enough spoolsvc, which is your printer service connecting to what I assume is your girlfriend's PC (Diane-pc?). Any idea why it would do that?
Do you need the bluetooth and the second LAN connection (called three in the pics?).
Unfortunately the graph in the LAN area is not quite in synch with the other ones so other than confirming that now and again you have something consumming 100% of the bandwidth it is very difficult to figure out what. There are advanced tools like Wireshark, but they are not something I am familiar with.
If you have a reliable backup software, you could try to backup, reinstall and see how it goes. If a clean install solves the problem you will have to pace yourself when installing apps and services so yuo don't miss which one was the culprit.

 

[tmantrask]

Thanks for the response. I developed an issue with my wireless printer about a week or so after the spiking issue began. My computer could see the printer & it would send stuff to the print queue but the printer would not print. I tried several things to resolve the issue including uninstalling/reinstalling the printer & software. I then set up the girlfriends laptop so I could print from there. Her laptop was on when I took the clip so this is why you can see it. As far as the Bluetooth & LAN 3, I don't use any Bluetooth devices so I don't need it & I believe my VPN service uses the LAN 3 (TAP Windows Adapter V9).

 

[tmantrask]

Also, I was thinking about restoring the computer back to Factory Settings using Dells Backup & Recovery software over the weekend to see if this resolves the issue

 

[tmantrask]

Just wanted to post an update. I finally did the factory reset & am relieved to say that this did the trick. I've been reinstalling programs & so far so good. Thanks again for all your help & I hope you are having a good holiday season!