Sloooooow Internet on SBS 2003

We have had a Dell server running for about a year with no problems. Config as follows:
-Single NIC in use
-SBS Server2003 SP2, DHCP (NIC set to static IP) and DNS, DNS forwarder to external router.
-External Router with DSL and Static IP, DHCP disabled.
-12 Workstations.

This last Monday, the Internet was slow more or less useless. Tried the following:
-New router.
-Reconfigured DNS and DHCP.
-Connect modem directly to workstation and have proper speed (About 5.5 mb up and .6 mb down)
-If I take the server off the network, connected workstations Internet speeds up to acceptable.

No changes were made to the server or network over the weekend; Quite baffled, any ideas?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Two thing i can think of...
1.. your server is infected with virus and it is using up all the bandwidth...  check the networking tab in the task manager and see if there is any traffic... (make sure no one is accessing the server when you do this)...

2.  an application is using up all the bandwidth... is it a web server, database, etc?

Moron6969Author Commented:
It is a web server with SQL and sharepoint.
I checked the network usage and is not abnormal, also the task manage shows no strange processes or unusually high CPU usage.

at this moment, when you don't see any adnormal behavior on the server, is the internet slow for other computers?
Cloud Class® Course: C++ 11 Fundamentals

This course will introduce you to C++ 11 and teach you about syntax fundamentals.

Moron6969Author Commented:
I tested some things this morning before anyone was logged on. I pinged and response times between 1300 and 1900 ms, usually should be 2 or 3 ms. Did the same from a workstation and got the same results; as soon as I disabled the Server NIC, the same workstation got 2 and 3 ms response and had acceptable Internet speed.

I would like you to use packet sniffer to capture the packet and see if there is any adnormal behavior...
A free implementation of a packet sniffer is wireshark... See for deatils:

Quickcheck... does your dsl activity light blink very fast when the server is connect to the internet?
Moron6969Author Commented:
I'll try that later this aft, I'm not at that customers right now.
The activity light blinks regularly when the server is connected, once every second or so.
Moron6969Author Commented:
Figured it out; 3 evil words... Symantec Endpoint Protection!
Uninstalled the pig and all is well. This has been on the server since new (about a year) and decided to pull some updates that caused the problem. Put SAV 10.1 on and have no probs!


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Glad you found the problem....
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.