Broadband connection speed very erratic recently

[Andy Spragg]

Evening all,

Running Win XP Home SP3, with SKy as ISP, and Online Armor, Avast!, Trojanhunter and MBAM as security software. The broadband connection was fast and stable until about a month ago. Now, it is very erratic whenever I use a browser. I'll boot up and Windows will tell me the connection is speed 54 Mbps, signal strength very good or excellent. As soon as I open a browser and start to do anything, the speed will quickly drop to 36, 24, 18 Mbps and usually as low as 11 or even lower. Thereafter it will fluctuate, but not usually higher than 24 Mbps (where it is as I type). Firefox, Google Chrome and Internet Explorer all behave the same way, so it's not a browser-specific problem. I can disable and reenable the connection without rebooting and observe the same behaviour.

Does anyone have any idea what might be going on here? I am loath to suggest malware since I have no other suggestive symptoms, and the various checks I have run come up negative, but I am at a bit of a loss to explain the behaviour otherwise. Hopefully,

Andy

[AdvancedSetup]

Please try the following.

You may have corrupted files on your disk. Please try running the following.

First close ALL Applications as this routine will automatically restart your computer.

Click on START - RUN and copy / paste the following entry into the box and click OK

CMD /C ECHO Y|CHKDSK C: /F | SHUTDOWN /R /T 30

Click on START - RUN and copy / paste the entry below into the run line and click OK

CMD /C NETSH FIREWALL RESET

Click on START - RUN and copy / paste the entry below into the run line and click OK

CMD /C NETSH int ip reset c:\resetlog.txt

Download and install CCleaner

• CCleaner
  
• Double-click on the downloaded file "ccsetup222_slim.exe" and install the application.
  
• Keep the default installation folder "C:\Program Files\CCleaner"
  
• Click finish when done and close ALL PROGRAMS
  
• Start the CCleaner program.
  
• Click on Registry and Uncheck Registry Integrity so that it does not run (basically the very top, uncheck it)
  
• Click on Options - Advanced and Uncheck "Only delete files in Windows Temp folders older than 48 hours"
  
• Click back to Cleaner and under SYSTEM uncheck the Memory Dumps and Windows Log Files
  
• Click on Run Cleaner button on the bottom right side of the program.
  
• Click OK to any prompts
  

Defrag the drive.

Uninstall any browser add-ons or plugins you don't often use.

[Andy Spragg]

Hello again Ron,

Thank you for such a fast reply.

The add-ons are I think a red herring. I installed vanilla Google Chrome specifically for the purpose of seeing if it behaved the same, and it did.

Defrag and Ccleaner I'm already fairly good with, but I'll run them and try the TCPIP stuff and report back. Thanks again,

Andy

[Andy Spragg]

Well, the TCPIP reset seems to have done quite a lot. Log below. Haven't defragged yet. Speed currently down to 24 Mbps, so I think there is still an issue, although at least the connection is strong and stable at 24 Mbps and certainly hasn't got really low (into single figures) yet.

Andy

reset SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\15\RegLocation

old REG_MULTI_SZ =

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpDomain

SYSTEM\CurrentControlSet\Services\TcpIp\Parameters\DhcpDomain

added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{49D7674C-33CF-4AB7-AE65-3B076357E6A3}\NetbiosOptions

added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{B974566D-9044-4481-9689-899DC7862892}\NetbiosOptions

deleted SYSTEM\CurrentControlSet\Services\Netbt\Parameters\EnableLmhosts

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1F3F29C5-DD83-42AC-BEBF-E28670245619}\DisableDynamicUpdate

deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1F3F29C5-DD83-42AC-BEBF-E28670245619}\IpAutoconfigurationAddress

deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1F3F29C5-DD83-42AC-BEBF-E28670245619}\IpAutoconfigurationMask

deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1F3F29C5-DD83-42AC-BEBF-E28670245619}\IpAutoconfigurationSeed

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1F3F29C5-DD83-42AC-BEBF-E28670245619}\RawIpAllowedProtocols

old REG_MULTI_SZ =

0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1F3F29C5-DD83-42AC-BEBF-E28670245619}\TcpAllowedPorts

old REG_MULTI_SZ =

0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1F3F29C5-DD83-42AC-BEBF-E28670245619}\UdpAllowedPorts

old REG_MULTI_SZ =

0

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{850799AA-979E-4249-A5A4-81C30F1C4565}\AddressType

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{850799AA-979E-4249-A5A4-81C30F1C4565}\DisableDynamicUpdate

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{850799AA-979E-4249-A5A4-81C30F1C4565}\RawIpAllowedProtocols

old REG_MULTI_SZ =

0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{850799AA-979E-4249-A5A4-81C30F1C4565}\TcpAllowedPorts

old REG_MULTI_SZ =

0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{850799AA-979E-4249-A5A4-81C30F1C4565}\UdpAllowedPorts

old REG_MULTI_SZ =

0

deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DontAddDefaultGatewayDefault

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer

deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\SearchList

deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\UseDomainNameDevolution

[AdvancedSetup]

You might also try a hard reset on your router to see if that helps improve anything. After the reset though make sure you go back in and set a password for the Admin on the router.

[swagger]

I had a similar issue recently and ended up going through 3 Linksys WRT54GL routers before buying a D-Link 655 which fixed the problem. I think it was a mixture of interference from other routers in the neighborhood on the same channels and poor antenna strength on the Linksys routers. My throughput speed would drop down as low as 1.0Mbps with excellent or very good signal quality and all wireless internet traffic would slow to a crawl. Wired traffic was fine. Don't rule out the router. You could try a reboot like AdvancedSetup suggested but worse case comes to worse, buy a router from a nearby Bestbuy or something to test with to rule out the router.

What type of router are you using if you don't mind me asking? And what firmware? Stock, DD-WRT, Tomato?

[calintexas]

Could it be reception quality (signal strength) between the router and the computer? Maybe you are just too far away for your components to work at top speed.

I pretty much use my wirelessly connected laptop from the same spot all the time, but find that the signal strength and speed does vary a bit depending on how the computer is turned. You might try fooling with the router antenna positioning or try moving the router higher or closer the the wirelessly connected computer if you can.

[swagger]

@calintexas,

Trust me, I worked with those 3 routers for about 4 months before I got fed up and bought the D-Link 655. I would be in the same room and still have problems at times with the throughput speed. If I was one room away, depending on the day & time, I would either get between 36-48Mbps or 1-2Mbps. And it worked perfectly fine (48-54Mbps) for about 6-8 months prior to the problems starting. Like I said, it was either interference from other routers and other devices using the same frequency range or weak antennas on the Linksys models. I think it was a mixture of both because the D-Link 655 worked out of the box perfectly.

But we are getting off topic, we are here to help Andy get his situation squared away

[calintexas]

Sorry swagger. I wasn't questioning what you said at all. I was just suggesting some simple things that Andy could try before changing routers. I think a different broadcast channel could be tried also (as I recall that most routers allow auto or specific channel selection). Andy may be stuck with the router he's got. For example, I have Verizon Fios TV and Internet and the special Verizon supplied router is connected to the TV set top boxes in addition to my computers. Fortunately it seems to work very well with the wireless connectivity fully configurable with WPA2 encryption.

[swagger]

No need to apologize I didn't take your post out of context. I was just giving you some background on my situation. You are completely right though, Andy may be stuck with that particular router and if he is... I'd be curious to see if a reboot of the router or changing the channels would fix his problem.

[Andy Spragg]

Hey guys,

Thank you all for your feedback. I think LIFO is required here.

Yes, I'm stuck with the router I've got in the sense that it was supplied by my ISP. I don't know enough about routers and broadband to know whether I can just swap it for any old one, but at the very least I presume I would forego any technical support from them.

I don't think it's reception quality because until recently, the computer seldom wavered from 48-52 Mbps/very good-excellent. It's only recently that things have gone unstable.

What type of router am I using, and what firmware? Now you're really taxing my capability. I have to log in to the thing to find that out, and I can never remember how. Hang on ... OK, it's a Netgear Super Wireless ADSL Router DG834GT.

As regards firmware, here's where it starts to get interesting. I can find version numbers of the firmware by logging on to the router (V1.03.87, and A2pB023b.d20e for the ADSL firmware), but no sort of identifier like the examples you gave, swagger. However, I did find a control for upgrading the firmware, and that diverted me momentarily to locate the Netgear homepage for possible future reference. I loaded the home page, clicked on the Support button ... and then MBAM popped up a system tray message saying "infection detected 69.64.155.19". I've repeated the whole process to be exactly sure of the sequence and IP address. Does this mean that part of the website has been hijacked/compromised?

I haven't done the hard reset yet, not sure exactly what it entails TBH. It isn't as simple as switch off and back on again, is it? The router currently has a generic username and password set by sky. I've never changed the password (they never said it was necessary, and the last thing I want is another password to remember). Should I?

Andy

[exile360]

There should be a very small button on the back that you may have to use a paper clip or the tip of a pen to push that resets the router. It would also be a very good idea to change the password as anyone could possibly get access by trying the default password and change your settings, possibly even changing the password themselves to lock you out of your own router. It's also possible that one or more of your nearby neighbors has recently gotten wireless and that you're getting interference from theirs. You can check by looking at the available wireless networks, if there's more than one then that means someone nearby has wireless as well. If that were the issue, changing the channel used for the signal could solve the problem.

[swagger]

If you are using a Netgear router supplied to you by the ISP and you aren't very familiar with firmware, then I can almost guarantee that you are using Netgear's proprietary (stock) firmware. I wouldn't advice trying to update your firmware at this particular time since you are relatively uncomfortable. You could try unplugging (power cycling) the router for 30 secs to a minute first and see if that fixes your problem or you could try the hard reset.

***Warning*** A hard reset will reset all of your router's configuration settings back to default. Instructions on how to hard reset can be found here: Reset and Reboot -- I know these instructions are for DD-WRT firmware but the concept should be the same for all routers.

[calintexas]

Andy - You should be able to find the users manual for your router at your ISP's website or at the Netgear website. If you want to be more secure, you need to set a srong access password for your router, make sure the router's hardware firewall is on, lock down your wireless connectivity so that you are the only one that can use it and so that your communications between your computer and router are secure. The main thing to do to secure your wireless is to set up WPA2 encryption between your wirelessly connected computers and the router. You can also turn off ssid broadcasting and specify MAC addressing, but it's the WPA2 that is the key. You want a full encryption key. Steve Gibson (https://www.grc.com/passwords.htm or https://www.grc.com/ppp.htm ) has a very nice utility that will generate one for you. WPA and WEP encryption are second and third (better than nothing) alternatives as both can be broken quickly.

If you haven't secured your wireless connection, it's possible that all of your neighbors are using your connection (for free) and observing your transmissions. It could be what's happened to your connection speed.

[AdvancedSetup]

Well let me interject here since you say it's from your ISP.

1. Your ISP should offer you 24/7 FREE support with this.

2. Even if your ISP did/does not then most of the larger brand router MFG do offer 24/7 FREE support as well.

3. It could be that the line coming into your house or up on a pole has been damaged by animals or weather and is helping to cause issues.

4. If this is a built-in modem/router from your ISP it could have entries that were set by them and if you change them then your connection may break

I would contact your ISP and have them see if they can help you, if not then setup an appointment to have them come out to the house and check things out there.

[Andy Spragg]

There should be a very small button on the back that you may have to use a paper clip or the tip of a pen to push that resets the router. It would also be a very good idea to change the password as anyone could possibly get access by trying the default password and change your settings, possibly even changing the password themselves to lock you out of your own router. It's also possible that one or more of your nearby neighbors has recently gotten wireless and that you're getting interference from theirs. You can check by looking at the available wireless networks, if there's more than one then that means someone nearby has wireless as well. If that were the issue, changing the channel used for the signal could solve the problem.

OK, I established the hard reset thing via the Sky tech support pages as well. I've done it once before, come to think of it.

As regards password, I'm still a bit confused, based on the Sky tech support pages. They actually do recommend changing the "password", though you have to burrow for the recommendation - it's not exactly upfront. But the reason I say "password" and not password is because they're not talking about the username/password password for logging on to the router, they're talking about the network key/wireless password password for connecting to the wireless network. Apparently this is set to a default value at the moment - it's on a label on the router - but it's eight alphanumeric characters and it looks pretty random to me. The username/password on the other hand is obviously common to all sky users. The IP address for logging on to the router is just some local "relative" address, not a "universal" address (as you can see, I'm not very conversant with network jargon), so you could only log on to it from this machine as far as I can see. So at the moment, unless the network key is shared by a whole batch of routers, it looks like connecting to my wireless network would be pretty hard, but logging on to the router would be a cinch, provided someone already had complete control of my machine via some exploit or other. Don't see what purpose it would serve, though (whereas ability to connect to the network is obviously useful)?

I presume you're talking about the username/password password? Why would Sky not recommend changing that but recommend changing the network key?

As regards channel conflict, does it explain why the instability would only set in when I open a browser? Before I do anything, the connection is fast and strong.

Eeek, I've jut seen three new posts since the one I'm replying to. That's what happens when you have to go and cook and eat dinner halfway through what is already a post that is taking some time to put together! Off to read the new stuff.

Andy

[Andy Spragg]

Looks like something further from me is required, so ...

Ron, you're absolutely right - I should really be relying on my ISP. But:

1) I want to make the call from an educated starting point so I don't get fobbed off with bullsh*t

2) I'm not yet convinced the origin of the problem is not software, mal or otherwise, on the PC, which is not their responsibility.

I did the hard reset but I haven't changed any password yet - I want to be sure that I'm changing the one the right one. I also want to be sure I can change it at all without getting into difficulty, and that requires a call to Sky which I also haven't made yet.

After the reset, it looked like problem solved for a couple of minutes, but then the old symptoms returned. At least we don't seem to go below 24 Mbps very much now; since Ron's TCPIP resetting, 24 Mbps seems to be very much a preferred value.

Before I did the reset, I tried changing channel. This also seemed briefly to make a difference before the old symptoms returned.

Calintexas, my router doesn't do WPA2. I do have other security-related options that I have not used yet, though - restricting by MAC address, disabling SSID broadcasting, disabling uPnP. Consensus seems to be that all of these are worth doing, certainly for a home network. I've done the second and third now. Opinions?

And finally:

I presume you're talking about the username/password password? Why would Sky not recommend changing that but recommend changing the network key?

As regards channel conflict, does it explain why the instability would only set in when I open a browser? Before I do anything, the connection is fast and strong.

Andy

[AdvancedSetup]

Well not much else for suggestions from me. I'd still contact your ISP and see what's up. I just recently had my ISP out and they found some bad cables. They fixed it and now my speed is just fine.

[noknojon]

Agree with Advancedsetup now - Your ISP needs to respond in some way -

You can send an email or sit on the phone (take a cup of coffee usually) and usually freecall -

You have all the 'good' basic info (better than most who call) so they will (should) not 'fob you off' -

[Andy Spragg]

Yup, I'll give them a call tonight. I'm still reeling from Ron getting his actually to visit his house. That must be virtually unprecedented, and certainly not a feat I expect to emulate.

If I'm honest, I've been putting the call off because last time I called for tech support (IIRC, Ron, it was the time I was having difficulties with the PC that with your help I at length disinfected), I got a load of flannel about how the wired connection from phone socket to router was too long, with the answer to the question "Why is it suddenly a problem when it's been just fine for 18 months, then" being a most unsatisfactory "Sometimes those long cables just go like that, Sir". They asked me to try it with a shorter cable, I said I hadn't got the one they supplied any more, they sent me a new one, and since I didn't fancy unmolishing a load of carefully tacked-in cable and ending up with a router halfway up the stairs, I didn't use it. Did they have any sort of point? I appreciate there must be some signal degradation if the router connection cable is say 5m rather than 2m, but surely not significant?

[swagger]

5 meters is roughly 16 feet if my calculations are correct. That cable distance shouldn't effect anything.

[AdvancedSetup]

No that length is not an issue unless it is physically damaged. The cable I'm talking about is the cable that is on a telephone pole and open to the elements and animals. I don't think the underground cables have this issue though so if you're not on a pole then probably not the same issue.

If you like we can go through some more, deeper scans for Malware but I'm quite skeptical that we'd find anything more.

[Andy Spragg]

No that length is not an issue unless it is physically damaged. The cable I'm talking about is the cable that is on a telephone pole and open to the elements and animals. I don't think the underground cables have this issue though so if you're not on a pole then probably not the same issue.

If you like we can go through some more, deeper scans for Malware but I'm quite skeptical that we'd find anything more.

Hi Ron,

Yup, I knew you were talking about the cable coming into the house. We're on a pole (as it were) so damage could be an issue - but the other PC currently on the wireless network seems to be working just fine. The one with the current issue is not the same computer as before (currently in dry dock for reasons unconnected), by the way, so we haven't done any scans of this one yet. We haven't; I've tried various experimental scans with the tools left over from last time, but have not found anything obvious. Let's hold the malware hypothesis as a last resort, at least till I've spoken to ISP. Which I'm just going to go and do.

Andy

[calintexas]

The more you can do to lock down your wireless connection the better. So, yes, do what you can. I recommend asking your ISP about providing a WPA2 capable router now that WPA has been cracked. WPA2 has been around since late 2004. Your ISP should have them now.

If your AV and Malwarebytes (both with current data) scans say your computer is clean, you can be pretty confident that it is.