High Upload Stats

[Be@sT]

I am in desparate for help. I have a problem something is uploading up to 800meg a day on my Telkom account. I have AV programs running on all the machines.

The only thing that I have seen that might be uploading is on one of the PC's there is a email that seems to stay in the outbox. The email was about 1 meg. But acording to our email stats we only uploaded 30 meg for the month?

Does anyone know a virus that will do this? This problem seems to come and go.

I don't know what to do any more.

Thanks in advance

 

[Highflyer_GP]

Used to have the same problem, it appeared to be some sort of malware. The only thing that sorted it out was a format and clean install of windows. After that immediately install an up-to-date AV, ASW and make sure that windows firewall is active all before connecting for the first time.

 

[wizzard]

Maybe also try install something like spybot to try catch anything the AV has missed

 

[PostmanPot]

Get a bandwidth monitor and go through 'ending programs' in task manager...

 

[medicnick83]

if it is happening all the time, worry!
maybe also, it's windows update downloading updates !

 

[Syndyre]

If its uploads specifically I'm guessing either a P2P program or some sort of malware, maybe sending out spam etc.

 

[incaseofire]

Surely a decent firewall will do the trick...something with rules etc.

 

[Syndyre]

It should.

 

[noswal]

Go here and download leaktest, if it works then your system is vulnerable

http://www.grc.com/lt/leaktest.htm

 

[Surv0]

yeah as potmans post says, get a bandwidth monitor such and netlimiter, it will tell you exactly which process is sending packets..

 

[gregmcc]

you can also close down all application and get something like tcpview, this will show all connections in and out of your machine. Also get a program called autoruns it shows all the programs that automatically startup and also apps that hook into IE etc etc. Its the easiest way to find out if you have malware.

Also like the other posters say, get a program to monitor the bandwidth - you should easily be able to see all the tops sites and pick out the dodgy ones.

 

[Be@sT]

Update on status.

Here is my Stats for Aug.:

Day Downloaded Uploaded
1 1.6559 MB 0.1131 MB
2 71.3286 MB 10.7352 MB
3 38.4168 MB 43.3614 MB
4 32.6054 MB 848.6597 MB
5 12.2385 MB 570.5872 MB
6 97.6470 MB 81.7021 MB
7 140.4168 MB 7.0217 MB
8 3.2274 MB 0.9960 MB
9 8.1313 MB 1.8635 MB
10 33.4980 MB 3.9799 MB
11 62.2532 MB 7.7451 MB

What i have done now is the folowing:
1. Loaded a decent AV.
2. Loaded Ad-aware
3. Loaded " Bandwith Monitor" (Not as efective as I hope. Pics up all network trafic, including between computers, as I use a router). Is there something else I can use?

Looks like the problem has been solved.

How far behind is the telkom stats. I know that it is not realtime but the dates seem wrong.

A big thanx to all for the help. Hope it stays away.

 

[bwana]

Try BWMeter then - http://www.desksoft.com/BWMeter.htm - it can differentiate between LAN and internet traffic. Put it on other machines and it can collate all the data for you.

 

[Roman4604]

The nastiest piece of work I've come across is a mail spam trojan called spooldr.exe. Similar symptoms, on startup it connects to its master for mail content & distribution list, then starts mailing the world (sending).

Its real trick, besides being invisible and having the intelligence to alter firewall rules, is that it installs a device driver that induces a BSOD on shutdown and since most anti-virus/malware programs require a clean reboot to install properly your stuck.

Only thing that got rid of it was AVG Anti-Rootkit.

 

[theStudent]

A software firewall may be the best solution.

Will allow you to block whatever seems foreign to you.

I use Sygate Firewall 5.6.. its free
http://www.simtel.net/product.download.mirrors.php?id=53687

I just block all the programs I dont want accessing the net. (including the dozen Windows apps that help themselves to my bandwidth to check for updates..)