Videos wont buffer?

[Pyyrhus]

So yesterday after browsing the internet normally, I came back a few hours later and none of the videos would buffer correctly. The gray line next to the red line on youtube would only go slightly ahead, then the red line would catch up and the dreaded spinning circle would begin. I regularly clean out my temporary internet files, cookies etc, and I've made sure I have the latest version of Java and Adobe Flash Player. I have my Windows up to date as well and I restarted the router as well. My computer downstairs is fine. I also tried using Firefox instead. Help?

[Ishan]

From the looks of it seems like your bandwidth is being consumed by some other process, perhaps some software update in the background or something. Or could be that your internet connection is lagging or something.

[PoleCat]

From the looks of it seems like your bandwidth is being consumed by some other process, perhaps some software update in the background or something. Or could be that your internet connection is lagging or something.

On another note maybe he's being throttled from the ISP? You're right that it looks like a process that might be limiting him but I wonder at his general connection speeds - I think that's something to determine before jumping the gun on internal processes.

But of course I could be wrong....

[Pyyrhus]

Well to give you an idea my average download speed before this crap was about 1.6-8 megabytes per second. And to the comment about me being throttled by the ISP, that doesnt make sense because my other computer works perfectly fine. I just now restarted the modem and nothing has changed either. How would i go about finding this process?

[irishron]

Virus? Trojan? Both possible.

[Ishan]

Press 'Windows key + R' to launch the run command and then type resmon to open the Resource monitor and in it check the network tab, it will show you all the .exes or processes that are consuming your internet bandwidth.
You can terminate a particular process from there by right clicking on it and then selecting "end process" option. Hope that helps.

[Pyyrhus]

Virus and trojan may be possible, but I have done a few scans and nothing has came up. Thanks Ishan. Anything specific I should be looking for? Under network there is System, then there are these svchost things. There is also rundll32.exe and it appeared when I played a video and disappeared when I xed out the page with the video. Is that our virus? Currently I am counting 4 scvhosts. I read that some malware will masquerade as scvhost because it doesnt care if two processes have the same name. What is my next plan of action?

[Ishan]

There's a "Receive" column in it, check which .exe is really sucking the download speed, that will be your culprit, if there's any. And rundll32.exe is just an executable file used to launch the data stored in various .dll files (Dynamic link libraries). But it could be very much be a spyware. Check where it's stored, it should be only in "Windows\System32\rundll32.exe".

[Pyyrhus]

Is this usual? All the svchost exe files have parentheses saying what they are, but one of them says: (LocalServiceAndNoImpersonation). Why would it say that? Iv seem to have lost the rundll32.exe, it just isnt there anymore, It was there for like 30 seconds when I saw it on my last reply now it isnt there. The svchost that is receiving the most is receiving 421 B/sec. For the process receiving the most it is iexplorer.exe, but that isnt really suspicious.

EDIT: Now I'm seeing a wmpnetwk.exe

[PoleCat]

Is this usual? All the svchost exe files have parentheses saying what they are, but one of them says: (LocalServiceAndNoImpersonation). Why would it say that?

Good question. Can you give us the full name of the svchost file and any info it has regarding the nature of the process? Maybe open up the Task Manager and take a screen shot of the Processes tab....

Iv seem to have lost the rundll32.exe, it just isnt there anymore, It was there for like 30 seconds when I saw it on my last reply now it isnt there. The svchost that is receiving the most is receiving 421 B/sec. For the process receiving the most it is iexplorer.exe, but that isnt really suspicious.

The rundll.32.exe is probably not related - it may have been a process that was only open when you ran something off the internet. But that svchost.exe that is moving that amount of data around could be something to look at. Again - can you provide a full name and path?

Here's something to try: Download Malwarebytes, install and then run it. After that please provide the log output. Maybe we'll see something you don't. Good luck!

[Pyyrhus]

Ill be back momentarily with a Malwarebytes log then. I cant find in the resource monitor where to get additional info, when you right click it says suspend process, end process, analyze wait chain, end process tree and search online. I cant do it in task manager because there all the svchosts look identical.

[PoleCat]

...[snip]...EDIT: Now I'm seeing a wmpnetwk.exe

Sorry. I didn't see this before. This seems to be a process related to Windows Media Player 11 and others have reported that it's a huge bandwidth hog.

After giving us your Malwarebytes log could you go to your Start button, select "Run..." and type in [msconfig]? Look at both your "Services" and "Startup" tabs for references to Windows Media Player in any shape or guise and tell us what you see. Good luck!

[Pyyrhus]

My full scan on malwarebytes is not yet complete but I would like to add that the svchost that is receiving the most data is also the one that says the impersonation thing.

[irishron]

Try this. http://answers.microsoft.com/en-us/w...b-8ae56047f95b

[Pyyrhus]

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.19.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
KIDS :: KIDS-PC [administrator]

4/19/2012 6:21:35 PM
mbam-log-2012-04-19 (18-21-35).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 488620
Time elapsed: 2 hour(s), 15 minute(s), 53 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

I found a couple references to WMP in msconfig, but they were both stopped. There was a windows media center receiver, and a Windows Media Center Scheduler. These are probably disables because through irishron's link I found a way to disable the wmpnetwk.exe which is kind of useless.

[Pyyrhus]

This is strange, the issue is fixed. My videos and download speed are back to normal. +rep to irishron and everyone else that helped me. Ill post here again if it starts happening.

[irishron]

Good to hear. And you're welcome.