Network TCP always at 100%, System or Svchost.exe

[Bkid]

According to my Firewall (Comodo Personal Firewall) either System or Svchost.exe is using 80-100% of TCP at all times, making it hard for me to use the internet at all. Also, my modem keeps resetting, which my friend told me was some safety thing or something, but I dunno. Ethereal is saying my ARP protocol is peaked at 100% at all times, and when I look at the log, it's a bunch of "WHO HAS [ip]? TELL [ip]."

Someone please tell me what's wrong to I can use the internet without my modem constantly resetting, and get my TCP back down to a reasonable level..

PC Stats in sig.

[GX1_Man]

So you are using a modem and not an Ethernet cable? First thing you need to do is make sure your system is clean:

http://www.computerhope.com/cgi-bin/yabb/YaBB.cgi?num=1134123580

Then you may want to disable the onboard NIC

But I suspect you will find the problem before doing that, if you follow the instructions above.  

[Bkid]

No no, it's my cable modem. I'm using an ethernet cable.

EDIT: and btw, I'm not by any means a computer noob. I keep my computer very clean about 90% of the time. I highly doubt there is anything on here that I haven't found yet that could be causing the problem. Just wanted to clear that up.

[Rob Pomeroy]

Does the network traffic decrease if you temporarily disable the firewall?

Do you have a static IP address?

[Bkid]

Static IP: Yes
Firewall: Already down (except for windows firewall. It might be down, but I haven't checked). I'm at school right now, so I can't check to see if my firewalls at home are down. I'll edit back later.

[Rob Pomeroy]

Can you find out from the firewall if you're being hammered by a particular IP address or on particular ports?  Is your firewall running "hardened" - i.e. not responding to any external requests?  What kind of modem do you have (cable/DSL/analogue)?

[Bkid]

Cable modem, and I can find out from Ethereal what ports and IPs. Included is an Ethereal log file with no programs open but Ethereal.

This is what it's usually saying:

Source          Destination          Protocol     Info
68.47.72.1      Broadcast             ARP        Who has 68.47.73.16? Tell 68.47.72.1
68.47.72.1      Broadcast             ARP        Who has 68.47.76.124? Tell 68.47.72.1

It's always Broadcast, and the Tell IP is almost always the same as the source IP. If you have Ethereal you can check the log. If not, I'll post a pic of it.

EDIT: Log pic

[tmml]

open task manager and look at the programs accessing the net. you can check them at www.processlibrary.com

you can also run msconfig and run the startup programs throught the library. you might have a worm.

[Rob Pomeroy]

Unless you're running any peer to peer software that's provoking these requests, I would say it's nothing to do with your machine or your network.  I'm not sure why your cable provider is allowing these through - they clearly have nothing to do with your network.  Perhaps you should check whether they can block them?  Particularly since it seems to be degrading your bandwith so much.

[Bkid]

open task manager and look at the programs accessing the net. you can check them at www.processlibrary.com

you can also run msconfig and run the startup programs throught the library. you might have a worm.

I'll try this first and see where it goes..robpomeroy, what could possibly be sending out "Who has, Tell" so much? I just can't think of anything that might be doing that..I'll try that website above, then post back.

[Bkid]

You need reliable advice on virus/trojan/malware removal and prevention.

I'm sorry, but how does whatever you just said help me in any way? I already Know how to find/remove all of that. I keep my computer almost 100% clean, if a virus/trojan/etc. was the problem, then I would be suprised...

[Fed]

Is 68.47.72.1 your IP address, if so I'd be surprised if you don't have an infection.
If 68.47.72.1 is not you then there is little you can do other than get your IP to track down the culprit or do it yourself & complain.
I suspect it's you, have you run Ewido?

[Scourged]

Ip address 68.47.72.1 resolves to host c-68-47-72-1.hsd1.ga.comcast.net
This georgia usa address is listed in spam and virus transmission databases.

[Rob Pomeroy]

Exactly.  It's a script running on a computer outside of the LAN.

[Fed]

Then his ISP can block the offender's ISP.