Network Slow down.

[Lockecole81]

It might just be me, but anyway it seems like my netowrk used to transfer data a lot faster.

Also I've noticed when I browse to other computers such as my sisters, when I'll click through the folders I want, and find the file I want to open and click it, then I'll have to wait 1-5 minutes before it's highlighted, then double click and it's another freeze up, it'll show as not respodning in task manager.

but if you give it time it'll work.

I was trying to transfer some files over to hers since it has the burner, and it just seems like it's taking 600MB worth of data forever to transfer over.

I might just be imagining it having been faster before.

But the lag ups when trying to get to a certain file are definitely annoying.

I'm not sure what info on hardware and such would help, so feel free to ask and I'll post what I know.

[Spider]

How many computers and what operating systems are on them?
How are they connected, router...hub...crossover cable...switch?
Has every computer been to Windows Update and installed all critical updates?
Does every computer report clean from Panda online virus scan (http://www.pandasoftware.com/activescan/com/activescan_principal.htm)?

[Lockecole81]

How many computers and what operating systems are on them?
server - win2kpro
sis's computer - win2kpro
bro's computer - win98se


How are they connected, router...hub...crossover cable...switch?
through a hub


Has every computer been to Windows Update and installed all critical updates?
Probably not, I don't know if the siblings update theirs too much, my sis usually has the auto update thing going, so hers should be fairly uptodate.
Dunno about brothers, have to run it and see.

Does every computer report clean from Panda online virus scan?
I'll have to check on this and repost.

Need to get the new virusscanner on my sister's computer, her norton's subscription just ran out so I decided I'd just put the new version of AVG free on hers like I have on mine, since from what I hear AVG is pretty good.

[Spider]

Run Spybot (http://www.download.com/3000-8022-10122137.html) on all your computers.
Make sure Spybot is updated before you scan.

Awaiting Panda scan reports.


Avg is pretty good as far as calling virus checkers "good" goes.

[Lockecole81]

So far ran Panda on mine it found some stuff in the temp internet files so deleted those, needed it anyway. Found the usual stuff on mine when I ran Spybot, cleared those.


Just did sister's computer...pandascan showed this.


Incident Status Location

Virus:Trj/Downloader.GK Disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\polmx2.cab
Virus:Trj/Downloader.L Disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\Belt.cab
Virus:Trj/Downloader.GK No disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\polmx3.cab[polmx3.exe]



Hrm, says it didn't do anything to that last one.

Anyway what I'm wondering about is what AVG is showing, which Panda didn't even pick up.

Last two days hers has scanned after I installed the new version of AVG free, it's showed the same few items.

Here's the report.

Partition table (MBR) ok Quick checked
Boot sector of disk C: ok Quick checked
System registry Software\Microsoft\Windows NT\CurrentVersion\Windows\Load Scanned
System registry Software\Microsoft\Windows NT\CurrentVersion\Windows\Run Scanned
System registry Software\Microsoft\Windows\CurrentVersion\Run Scanned
System registry Software\Microsoft\Windows\CurrentVersion\RunOnce Scanned
System registry Software\Microsoft\Windows\CurrentVersion\RunOnceE x Scanned
System registry Software\Microsoft\Windows\CurrentVersion\RunServi ces Scanned
System registry Software\Microsoft\Windows\CurrentVersion\RunServi cesOnce Scanned
System registry Software\Microsoft\Windows\CurrentVersion\Run Scanned
System registry Software\Microsoft\Windows\CurrentVersion\RunOnce Scanned
System registry Software\Microsoft\Windows\CurrentVersion\RunOnceE x Scanned
System registry Software\Microsoft\Windows\CurrentVersion\RunServi ces Scanned
System registry Software\Microsoft\Windows\CurrentVersion\RunServi cesOnce Scanned
System registry Software\Microsoft\Windows\CurrentVersion\Winlogon \Userinit Scanned
System registry SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell Scanned
System registry exefile\shell\open\command Scanned
System registry scrfile\shell\open\command Scanned
System registry scrfile\shell\config\command Scanned
System registry batfile\shell\open\command Scanned
System registry cmdfile\shell\open\command Scanned
System registry comfile\shell\open\command Scanned
System registry piffile\shell\open\command Scanned
System registry giffile\shell\open\command Scanned
System registry htmlfile\shell\open\command Scanned
System registry htafile\shell\open\command Scanned
System registry jpegfile\shell\open\command Scanned
System registry txtfile\shell\open\command Scanned
System registry regfile\shell\open\command Scanned
System registry cplfile\shell\cplopen\command Scanned
System registry Word.Document.8\shell\open\command Scanned
System registry WordPad.Document.1\shell\open\command Scanned
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe ok Quick checked
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe ok Quick checked
C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe ok Quick checked
C:\Program Files\Ahead\InCD\InCD.exe ok Quick checked
C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe ok Quick checked
C:\Program Files\Internet Explorer\IEXPLORE.EXE ok Quick checked
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE ok Quick checked
C:\Program Files\QuickTime\qttask.exe ok Quick checked
C:\Program Files\SyGate\Sygate\SyGate.exe ok Quick checked
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe ok Quick checked
C:\Program Files\WildTangent\Apps\CDA\CDAEngine0400.dll ok Quick checked
C:\Program Files\iTunes\iTunesHelper.exe ok Quick checked
C:\WINNT\System32\mshta.exe ok Quick checked
C:\WINNT\regedit.exe ok Quick checked
C:\WINNT\system32\SHELL32.DLL ok Quick checked
C:\WINNT\system32\\NeroCheck.exe ok Quick checked
C:\WINNT\system32\atiptaxx.exe ok Quick checked
C:\WINNT\system32\mobsync.exe ok Quick checked
C:\WINNT\system32\rundll32.exe ok Quick checked
C:\WINNT\system32\vasikr.exe ok Quick checked
C:\IO.SYS ok Quick checked
C:\MSDOS.SYS ok Quick checked
C:\WINNT\system32\kernel32.dll ok Quick checked
C:\WINNT\system32\wsock32.dll ok Quick checked
C:\WINNT\system32\user32.dll ok Quick checked
C:\WINNT\system32\shell32.dll ok Quick checked
C:\WINNT\system32\ntoskrnl.exe ok Quick checked
C:\WINNT\system32\in9bDs.dll:\bi.dll Trojan horse PSW.Bispy.A Infected, Embedded object
C:\WINNT\system32\in9bDs.dll:\biprep.exe Trojan horse PSW.Bispy.B Infected, Embedded object
C:\Documents and Settings\Administrator\Local Settings\Temp\polmx2.cab:\polmx2.exe Trojan horse Downloader.Agent.AS Infected, Embedded object
C:\Documents and Settings\Administrator\Local Settings\Temp\biD.cab:\bi.dll Trojan horse PSW.Bispy.A Infected, Embedded object
C:\Documents and Settings\Administrator\Local Settings\Temp\biD.cab:\biprep.exe Trojan horse PSW.Bispy.B Infected, Embedded object
C:\Documents and Settings\Administrator\Local Settings\Temp\Belt.cab:\Belt.exe Trojan horse Downloader.Stubby.A Infected, Embedded object
C:\Documents and Settings\Administrator\Local Settings\Temp\polmx3.cab:\polmx3.exe Trojan horse Downloader.Agent.AS Infected, Embedded object
C:\Program Files\Common Files\updmgr\updmgr.exe Trojan horse Downloader.Keenval.R Infected



I tried to delete that updmgr folder and it won't let me so I'm guessing I'll have to look up info on how to remove those from her computer? could very well be what's slowing it down.

Still need to run panda on brother's computer, and also check windows updates on each computer. Kinda hard to do the stuff when someone is always on the net, and it being dialup tends to lag the hell out of whatever game someone is playing.

[sublime0609]

test your bandwidth HERE (http://www.bandwidthplace.com) and see if its what its supposed to be at...cable usually runes at 2mb/second-to around 3mb/second (mines at a steady 2.8mb/s) for dsl i believe you should be running at around 1mb/s....if its alittle slower than that dont worry...your network is slowing it down alittle...but if its super low...like 200-500kb/s for dsl and maybe 500kb/s-1.5mbs then i dont think its supposed to be that slow...

i might be wrong , because the different broadband internet companies in different areas may have slower/faster speed than others

[sublime0609]

and you need to get rid of all that stuff you posted above my 1st post in here.....i would use ad-a-ware 1st, then run spybot s&d, then run your av software to get rif of anything remaining.

[bAdWaYz]

Thier broadband connection speed wouldn't really do much to cause slow file transfers on the local network. The speed of files being shared between computers has more to do with what type of network standard they run "802.11b or g" and so on. The bottleneck may have more to do with either spyware, virus, or network setup.

[Spider]

Virus:Trj/Downloader.GK No disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\polmx3.cab[polmx3.exe]
Hrm, says it didn't do anything to that last one.
You should be running the scans in Safe Mode.

[sublime0609]

Thier broadband connection speed wouldn't really do much to cause slow file transfers on the local network. The speed of files being shared between computers has more to do with what type of network standard they run "802.11b or g" and so on. The bottleneck may have more to do with either spyware, virus, or network setup.
i stand corrected then:donatello

[bAdWaYz]

Just wait z1p will point out a mistake of mine. He has corrected me once already, but thats why he's so awesome to have around. No one is perfect thats for sure. Some of us are just so old we have seen a bit more :)

[Lockecole81]

replying to last for ease

I was just running the panda scans in normal mode, didn't think to enter safemode with networking enabled.

Anyway I got everything removed off sis's computer, AVG had a virus cleaner that removed the ones that Panda didn't even find.

Still need to do Panda on brother's as well as a spy bot, I also have some other things to try.


I didn't go to the site provided since it's a local network, computer to computer.

Think they all have the same realtek based cards.
They all go through a hub I have, using Netbeui and such for protocols.

I have a few other things to try, didn't think that having the extra cable length coiled up would be bad, kinda have them in figure 8s but that could be a problem too, so think I'll check that out.

think I'm gonna see if the network access is any better before turning my computer off for the night.

[Lockecole81]

Accessed sis's computer just now and dropped folder over that I wanted to burn to CD, her computer has the burner since she bought it haha. Anyway I was able to navigate prettye asily, dropped the folder in, about 600+MB and it's actually transferring pretty good. So maybe it's gonna be running better now, I'm gonna try navigating to some of the folders that had music and see how it loaded, used to take forever before you could click on a file and even open it.

It seems to be working a lot better compared to previous days. So maybe the cause was the viruses on sister's computer I got cleaned off.

Yay now it won't take over a day to transfer 600MB to burn a CD =P

[z1p]

Just wait z1p will point out a mistake of mine. He has corrected me once already, but thats why he's so awesome to have around. No one is perfect thats for sure. Some of us are just so old we have seen a bit more :curse: Old, who are you calling old... why if I ever meet up with you I'll use my cane on ya.... The kids these days, have no respect.;)

I agree with you Badwayz.

You could ping the other machines to get a feeling for your network performance. (from the command prompt run 'ping other_pc_name' ) On a local network you should usually see pings <1ms. If you really want to geek out, you could use something like ethereal to capture the network traffic and see if anything seems odd. You really need some knowledge of how networking works for this (or at least the desire to learn about it).

[Lockecole81]

I did a 100 packet ping, and it came back saying the very first ping was 1082 MS, not sure why the first one was high, but the other 99 of them said either
=10ms
or
>10ms

Average was 12ms.

After removing the viruses on sister's computer it seems to be running better, I really should still untie the excess cable and lay it out or something and see if it improves, but now you're at least able to navigate the network without waiting minutes because of "lag". Was also getting to where the window would stop responding.

[Lockecole81]

Still having some trouble with the network.

What can cause packet loss on a home network?

For example I was explaining to my brother a couple problems just since I was talking about it.

Showed him on his computer I could ping our Sister's computer, did 30 packets from his and 3 timed out, said it was15% loss. But all the others went quick at about 1-2MS

Now if I ping mine from his it all times out. Which I don't understand. But I'm thinking I should try swapping out the cable that goes from my computer to the hub and seeing what difference that makes.

I'm pinging my sister's from mine currently...the results are as follows
packets sent 50
6 were lost for a 12% loss.
Average time is 4MS

I've scanned for spyware, and their coming up clean for viruses.

Wondering what else it could be.

I read it's not adviseable to have the network cable running along near your power strip? Wondering how I can move my cable. Maybe get a new one and run it up along the wall away from it, since this one is short and has to run next to it.

Wanting to burn some data to cds, and it's dificult to transfer it to the other computer with the network running crappy *frowns*

[Lockecole81]

Pinged brothers' from mine with 25 packts and it was 100% loss.

Wonder what is up...it used to work so well.

[bAdWaYz]

packet loss most times is due to either network setup issues or hardware issues. I'm not sure what may be the cause of this loss in your case. It is clear however that packets are getting lost at some point or points in your network. I would look at connection points first. Any place that cat5 connects to a port either hub or back of a computer make sure the cable is plugged into the port well. A lose or wobbly connection can cause issues.firewalls and local lan settings would be next on my list.. Make sure all the computers running a firewall are setup to allow traffic from the other computers. Make sure the ip addressing for each computer is correct. Maybe use a switch instead of a hub. Switches can actually switch packets so there is less packet collide and loss. It could be something simple or something as hard to track down as a windows setting. I once spent a week sorthing out packet loss over a network after the user said he didn't change a thing. I found out that the settings for tcp/ip filtering had been changed in his Windows 2k settings. Windows 2000 has a setting for TCP/IP filtering located in Network Places Properties> LAN Properties> Internet Protocol TCP/IP Properties> Advanced> Options. He had changed that and didn't know it. So see its not always something one can spot right off hand. At any rate post back and let us know how its going. Good luck to you and with time and a little work we can sort this out...cheers!

[Lockecole81]

That TCP/IP filtering you mentioned, should it have a check mark in it, or should it be blank?

I had checked on mine just to see and mine is blank.

I'm still kind of experimenting with things. One that I'm wondering about is I went to transfer some files over, and it kind of just sat there, so I thought I'd try something and unplug mybrothers cable to his computer, started showing time remainingwas about 33 minute but fluxuates up and down to about 40-60 minutes but it's a 10 megabit hub I think, so transferring 600 megabytes would probably be about right.

I know all the cards are 10/100 but I don't think the hub is.

Anyway something I was wondering while transferring I was watching the hub and it occasionally has lights that flash up on the lights indicating the empty ports...and it has a small orange one that flashes and the light is labeled collision.

I've been pinging my sisters computer while writing this and currently this is the info on it

Host Name IP Address Hop Ping Time Ping Avg % Loss Pkts r/s Ping best/worst
HEATHER 90.0.0.2 10ms 3ms 11% 1381 / 1564 0ms / 21ms


The ping is pretty decent, I'm just wondering what's causing the packet loss.
I'm wondering if that's what the collision light on hub is indicating.

I'm planning on switching out the cable from my computer to the hub with another and seeing if there is any improvement.


I do wonder why when I ping my brothers computer all I get is
100% packet loss, every ping times out.

To sis's it's only occasional ones.

Might have to double check his settings on his and maybe reinstall the netword card driver, see if it makes any difference.


I just wonder what could have changed that makes it run the way it does now when it once ran so good. Have to double check stuff on his.

[Archangel122184]

If it is always 100% loss, chances are his firewall (if he has one) is stopping the echo request.

There is also something else that is possibly at play here. As a network administrator I have seen all sorts of problems. One of my least favoites is network congestion. This can wreak havoc on network services unlike anything I've seen. You mentioned that you see a "collision" light on you hub light up on occasion. This is the only sign that we really have of network congestion without using managed switches.

What litterally happens when that collision light goes off is two computers tried to send information at the same time or so near the same time that they couldn't detect that the other was tansmitting. Unfortunately on a hub, that information gets intermixed (or a collision happens) and the sending computers can verify that the information was sent intact. So it sends out what is called a jamming packet and stops all network traffic for a short period of time. This has a very good chance of being the cause of your network woes.

These collisions are random at best and usually happen durring high traffic periods. This does not have to be something with your computer, it could be many other issues. Your brother or sisters computer could have a virus or spy ware that are constantly probing the network or contacting off site locations. I would look at your brothers computer first since his is the one that won't respond to you.

If you check all of the computers and manage to satisfy yourself that everyones computers are clean, I suggest that you try replacing the hub with a switch, this will help control your network traffic a little better.

FYI: There are 2 things that tell me you have a hub and not some other device. First and most importantly, a hub is the only device in which a collision can happen. Second, your sisters IP address is 90.0.0.2 which is not a private local network address.

[bAdWaYz]

Thanks for posting back with an update Lock. I'm sure this ongoing issue has given you plenty to think about. At best at least I can say that it seems to be narrowed down to that hub or yours. As I pointed out

Maybe use a switch instead of a hub. Switches can actually switch packets

Archangel seems to agree with me on that point so being as a small 4 port switch is pretty cheap why not give that a go. My bet is that you will see an improvement.

[Lockecole81]

The IP addresses were just ones I had set ont hem, can't remember why I went with 90 as the first part, might have been something that suggested it.
I have no idea, but yeah it's a 5 port hub.

Guess I could look and see how much a switch would be. Haven't really ever used one, does it just plug up the same for the most part?

That would make sense about his firewall stopping the echo, since mine and his have the same one. Didn't think of that haha.


I was still kind of wondering about this part.

"That TCP/IP filtering you mentioned, should it have a check mark in it, or should it be blank?"

[Lockecole81]

Concerning the IP it seems like the internet sharing I have usually suggested 168 something for the IP or somewhere around there, but for some reason I just set it back to 90 from some reason I can't think of.

Plus it's just quite a bit easier to remember =P

[Lockecole81]

Seems like the switch might be best way to go if it controls packets better.

Was trying to copy over the new edition of Adaware (SE) and it came up saying some unexpected network error occured.

Unplug sis's cable and do it and it goes over fine.

[Archangel122184]

To answer your questions:

Any form of TCP/IP filtering and QoS packet scheduling should be disabled.

A switch will integrate the exact same as a hub, the only difference you may see is there may be no "uplink" port, this is because most switches are autosensing for uplink/downlink.

[Spider]

Since this is a home network and has a minimal amount of computers I would
go to a router instead of a switch. Switches are more for heavy loaded networks
where without load balancing you would have too much lag on some of the less
used systems.

A router will offer you DHCP (you can forget about assigning IPs to computers via Windows)
and a certain amount of defense against some of the more modern exploits.

Since you've found a lot of garbage on these systems (virii and such) it really isn't
fair to put blame on lag to anything but parasites. To clean all this up you need
to ensure each machine is virus and spyware free and after that is complete you
need to shut off unnecessary programs from starting up when the computer starts
(msconfig-startup<tab>).

Then all temporary internet folders must be emptied and the setting in
Internet Options...
Advanced(tab)
and a checkmark on Empty Temporary Internet Files folder when browser is closed

From there it's directly into Safe Mode (for the win98 machine) and a run of
scandisk and then another reboot into Safe Mode and run defragmenter.

On the win2k machine it's a boot into the 2k CD and Recovery Console and then
chkdsk /r
and then a boot to Safe Mode for a run of defragmenter.

Once cleaned and serviced with above then each machine needs to be totally updated
at Windows Update till no critical updates are showing for download.

Each machine can be checked for updated drivers for the ether cards (Windows Update is good enough
if the drivers show up there).

Work? Yes. Lots of work? Yes. This is what it takes to get the machines clear of fault.

If you want to see what running with a switch is like then unplug all but two computers
and try a transfer...that is a load balanced network because there are only two computers
accessing the hub. You'll find there is little if no difference on that home network.

[z1p]

I disagree a switch can be as appropriate for a small home network as a router. (Belkin and others make fairly inexpensive switches) The question really is where in the network config it is going. If it connected to a broadband mode, a router is the better choice. If it being used just to connect PC on an internal network a switch may the better choice, in that they can be easier to configure and maintain.

Spider's last suggestion is a good one. Connect the PC in pairs (with or with the hub) and check your network. Other approach is to remove one PC at a time and see if there is any difference in the collision light on the hub. If you remove a PC from the network and collisions lessen, then you can concentrate on why that PC is generating so much network traffic.

[Archangel122184]

Please take both of the above posts into consideration, there is some very good recomendations, but there is some information that I feel is needed that they left out.

First, unless you get a true router, you are still going to be replacing your hub with a switch. A multiport router (costing usually in the hundreds of dollars) creats a new network for each port (networks that unless programmed to do so can not talk to eachother with protocals other than tcp/ip or udp). Now, the single port routers with the 4 port switch embedded (which is what you want to buy) will create a single network allowing you to use lan protocals (ie NetBIOS file sharing and such) and allowing access to this network through the 4 port swtich. You haven't said much how you are connecting to the internet so I can't make a resonable recomendation about which you sould get (either a router or switch), but please consider as spider mentioned, the router will give you a hardware based firewall which adds a considerable amount of security to your local computers.

[bAdWaYz]

Great posts guys! All the imput we have given Lock sure gives them plenty to think about. At this point I think it is safe to say that they will come away from this forum very well informed. As far as what they want to use a switch or router, I'll leave that up to them, but at least now they have some info to help them along. Thanks for all the imput guys keep up the good work.

[Lockecole81]

Connecting to the internet via dialup as broadband isn't available in my area *mumbles some curses*

Spider, the problem I'll have trying to do all that stuff is finding a time when I can access those computers or to be able to update by the net without someone playing a game.

I try to do regular scans with adaware and spybot, on mine, and occasionally on theres. Have to make sure I do it a little more often. Last I've checked the AVG on each computer was showing it to be clean and when I ran those pandascans it had said they were clean.

I'll try doing the other things when I'm able. The first parts will be easy, it'd be the updating that would be a pain, although really it should only be my brother's computer that would need it. Sister's does an auto update usually, and mine I recently did.

[Lockecole81]

What's the Uplink port on these hubs for?

[bAdWaYz]

An uplink port on a hub or switch allows you to use a regular Ethernet cable to join the hub or switch to another. Also as a side note since you are on dialup it may be easier for you to do updates such as SP2 and the like via the SP cd's you can order from MS. I know that its a little late to advise that now but for updates down the line you may want to think about it. Makes updates go alot faster and also one can build a slipsteam install of XP with the latest service pack with those disks. Just something to think about, good luck.

[Spider]

finding a time when I can access those computers or to be able to update by the net
I tell dial up customers to start the update just before you go to bed. That way
your done by morning.

As bAdWaYz has said the uplink is as he explained. Old timers call it "daisy chaining".