Mysterious Bandwidth Usage

[NomNom]

Could be a Trojan. I had one and it sucked bandwidth even when my computers where off...

Best lol of 2010 ..please explain to me how a trojan uses your bandwidth when your pc is off? I find that quite fascinating..

 

[bekdik]

I presume that thw wireless option in the modem is either disabled or at least tied down to mac addresses?

 

[Guantanamo]

Best lol of 2010 ..please explain to me how a trojan uses your bandwidth when your pc is off? I find that quite fascinating..

Im not quite sure either but the way it was explained to me is that your ip address or something was stolen and the person on the other side just plugs that in and downloads, but that was nashua's customer support(or lack thereof)

 

[Venom Rush]

One thing you can also try is to disable the 'background intelligent transfer service'.

Go to computer management, then services, double click on it and by startup type select 'disabled'. Stop the service as well.

Had a few computers before, that even after disabling everything, they were still downloading stuff until I switched that service off.

Thanks, I'll give this a try.

@KillaByte
It's different each day. Some days it's only up to 500Mb and some days it goes up to 1gig. Needless to say, this is far from ideal.

 

[Venom Rush]

I presume that thw wireless option in the modem is either disabled or at least tied down to mac addresses?

Yes, the wireless option is disabled. That was the very first thing we did.

 

[Venom Rush]

My boss runs skype and has decided to turn that off for today to see if that may be the culprit...

What I don't understand is this...the bandwidth usage is only ever used while our pc's are on, but we've both done a scan with NOD32 and Malwarebyte's Anti-malware, and both programs found nothing.

 

[Venom Rush]

Ok, so I've installed NetLimiter 2 Pro and I see that ekrn.exe is using some bandwidth. But the file is associated with NOD32 which we only installed when I started this thread. Regardless, I checked what IP addresses showed up under the 'Process' tree and came across this IP:

67.228.53.122

I did a tracert on this IP and came to this address:

si-sv3553.com

All searches on the internet don't reveal much about this IP address so I'm led to believe that it isn't ESET's server. But considering traffic from other applications is re-routed through NOD32 it could be anything

 

[HavocXphere]

There is a 5 page thread about afrihost cap disappearing here. Do note that not all of those complaints are justified though. In some cases the people just don't get that the afrihost cap works differently to other ISPs.

 

[Venom Rush]

My boss and I have both updated our firefox to the latest version 3.6 and it's been over an hour since we did this with very little bandwidth used. I think perhaps a vulnerability was being taken advantage of, whether it was on my machine or my boss'. I was running version 3 and my boss was running 3.5

We're gonna keep an eye on it for now and I'll report back with more soon.