Help Me, Hive Mind!

[kaasirpent]

I'm looking for a freeware Windows application that will show me per process how much of my current Internet bandwidth is being used, and it would be nice if it also told what IP addresses were connected.

I have done many Google searches over the last 24 hours or so, and I have yet to find anything that fits the bill. I know that some routers will do this, but mine will not, so I'd need for this to be at the OS level because I'm not interested in spending a bunch of money.

I suspect that I'm still harboring some process or processes on my machine that are doing bad things without my knowledge. I'd like a way to track it down and either destroy the offender or have a good reason to reformat my drive and start over from scratch (yes, it's that annoying).

I could go shareware if it doesn't cost too much or if it's a fully functioning application that dies after x days of usage or whatever. What I'm not interested in are hobbled demos or anything that scans, says there are potential problems, but requires me to pay just to get the "Oh! Nope, nothing's wrong, sorry for the anxiety" message. (i.e., "scams")

So far, everything I have found is designed for corporate net-nazis to track what their employees are doing with every CPU cycle. I'm not interested in paying corporate prices, nor am I interested in installing something that will itself cause more problems than it fixes.

One symptom, if anyone's interested, is periodic extreme slowness of network access to the point where I have to reboot the cablemodem and/or router. Now, I know I had some trojan/viruses that every monitoring application I have installed assures me are gone (I use AdAware, SpyBot Search and Destroy, AVG Virus Scanner, and Spyware Doctor; all upgraded to the latest version often). Another symptom is that occasionally, my computer will just...freeze. No rhyme or reason. Just...freeze. And I have to one-finger-salute it because it can't see the keyboard. And during these freezes, the hard drive light is furiously blinking.

The only thing I haven't specifically checked for are rootkits, but I do that about once every four months. I'll do that, tonight, when I get home.

But anyway, if you know of an app like the one I've described, let me know. I'd certainly appreciate it.

Comments

[awl.livejournal.com]

http://technet.microsoft.com/en-us/sysinternals/default.aspx

Sysinternals has something called TCPView will do half of what you want. It will tell you what every process is doing with tcpip. Sort of like what netstat will tell you only better.

I don't know anything that will work with bandwidth monitoring per process. You might be able to use a bandwidth monitoring tool and hopefully match up the ports with tcpview.

If it turns out that you have some kind of malware, it may be using bittorrent. (Not to worry you with a wild theory!) Many routers don't handle bittorrent traffic well and require reboots.

Most of the bandwidth questions could be tested if you have more than one computer on the network. If your connection seems slow, try it from the other computer. If it is slow there, unplug the computer in question. If the slowness continues, it isn't the computer it may be the ISP or router.

[kaasirpent]

Thanks, I'll check that out.

The viruses I had were of the type that opened web pages and popped up nasty ads and constantly were interfering with my net access. They appear to be gone, but.... :)

As for the other computer, I intend to try that tonight. I have a second computer, but it has a bad fan that tends to moan a lot and it annoys me, so I shut it off unless I need something off it.

[geek-72.livejournal.com]

Awl is right about the programs from sysinternals and I would also check out

PortMon
v3.02 (November 1, 2006)
Monitor serial and parallel port activity with this advanced monitoring tool. It knows about all standard serial and parallel IOCTLs and even shows you a portion of the data being sent and received. Version 3.x has powerful new UI enhancements and advanced filtering capabilities.

Process Explorer
v11.33 (February 4, 2009)
Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process.

Process Monitor
v2.03 (December 10, 2008)
Monitor file system, Registry, process, thread and DLL activity in real-time.

http://technet.microsoft.com/en-us/sysinternals/bb545027.aspx

remind me next time I am there and I will swap out the fan for you so it doesn't moan anymore.

[kaasirpent]

I actually have Process Explorer. Use it every day. It's how I know the company is, indeed, tracking what software we have and use on our work boxes.

[oxlahun.livejournal.com]

Ditto what geek_72 said.

I had a nasty one a couple months ago, and Malwarebytes' Anti-Malware was the only thing that would take care of it.

Zone Alarm is moderately useful, too, because the default setting is that you must specifically allow network access for every app that wants it. Unfortunately, my experience is that it's fairly easily compromised, so you have to put it on a clean box to start with.

[kaasirpent]

Heh...my experience with Zone Alarm was that even after you uninstall the thing, it interferes. I think I ended up having to reformat my hard drive and re-install windows to get rid of Zone Alarm, last time. :)

I'll hold it aside as a last-resort solution.

I'll check out Malwarebytes.

Windows Network Monitor

[craftsman.livejournal.com]

http://www.microsoft.com/downloads/details.aspx?FamilyID=f4db40af-1e08-4a21-a26b-ec2f4dc4190d&DisplayLang=en

External protocol sniffer. Grab a second machine and it will watch everything going over the wire from the first.

Oh, and it is free.

[the-peej.livejournal.com]

Maybe its just your superpower manifesting itself in new and interesting ways?

I'm curious too.

[hoo.livejournal.com]

I'd like something like that for our Windows boxes at home.

I was hoping Sourceforge or Freshmeat would have something that has a Windows port as well, but didn't find anything.

If you're still hitting Google for it, it looks like the two applications that the UNIX world uses when netstat doesn't provide enough information are 'sockmon' and 'sockstat'. Doing searches on those get me results that set off alarms on the corporate web nanny for 'hacking'.