Help, unknown download???

DampDog · 15 Jun 2014 at 19:47

OK, slightly odd one but I've really not got a clue as to what may be causing this to occur.

Right I have BT infinity with a usage cap of 40 Gig. No problems, I'm not a heavy user I get usually get buy on under 20 Gig. Now I use the the usage monitor to keep an eye on it and check it most days. Past couple of weekends I have seen some unusual usage spikes. Last Sunday 7.5 Gig, Sunday before 3.0+ At first I thought It had just been a large update or perhaps something large that I had not noticed. I thought just to be thorough I'd stick on a free usage monitor and keep an eye on it.

Bob's your uncle at 19:00 I see another big spike in usage, 800mb before I spotted it in the background.

I really have no clue as to what it may be. I don't knowingly sync anything to the cloud or whatever. I'm properly stumped as to what it may be???

Only clues I have are. These IP's from the usage log

2.18.242.40 15/06/2014 19:00 15/06/2014 19:15 198094Kb
2.18.242.32 15/06/2014 19:01 15/06/2014 19:12 99047Kb
2.18.242.18 15/06/2014 19:08 15/06/2014 19:15 51632Kb

Any ideas???

DampDog · 15 Jun 2014 at 20:00

Craig321 said:
Check the resource monitor in the task manager next time it happens. In the network tab you can see which processes are using the most bandwidth.

I've missed my chance tonight as I killed the power to the BT Hub, in panic... Restarted it and it's just sitting quietly as normal.

I'm mystified, 7.5Gig & 3.5Gig on separate weekends so far, where's it potentially putting the data?? Never had anything like this before, it's freaked me out.

DampDog · 15 Jun 2014 at 20:11

Craig321 said:
By the way 2.18.242.40 is Akamai which is a huge CDN, so difficult to tell from that address unfortunately.

Sorry, I'm clueless, dunno what a CDN is..

I have very little in the way of games, those that I do have are all via Steam.

DampDog · 15 Jun 2014 at 21:06

Thanks for the advice. Antivirus wise I stay up to date (McAfee) stay well away from dodgy sites and keep window (7) and everything else up to date. Only app I've knowingly installed over the past couple of months is Chrome. The few games I run are via Steam, and I only start Steam when I use it, its not running in the background.

Have to say its freaked me out somewhat as I'm pretty careful. Its already used up 10Gig this month, and that's just what I've managed to measure using a downloaded usage tool. I'll have a look through its log for today in the morning.

Mystified at the moment. Never had anything like this before.

DampDog · 15 Jun 2014 at 21:22

I'll have a look at that. Oddly I was using it this morning. But as far as I know I haven't left it running. I will take a look at the settings in the morning. As I say, never had anything remotely similar. I'm freaked out and baffled in equal measure. I can't think of anything on the machine that would need 7gig+ of updates anyway. Its a very odd one.

DampDog · 16 Jun 2014 at 11:31

KIA said:
Does the local usage meter match BT's online usage meter?

They are not identical but pretty close within 50-100mb. I do have 2 tablets running via Wifi so suppose they could account for the tally being slightly out. I checked their usage logs and they are both just 10's of Mb for the whole weekend. I've run Malware Bytes this morning, it's flagged nothing. Also done full system scan and again nothing.

This is a screen grab of the beginning of the odd download. I stopped it by switching off the BT HUb, and it did not start downloading again after being re-started just went back to normal. I've taken a copy of yesterdays usage monitor log of sites visited and will have a look to see if I can spot anything odd. Might take a while as it only lists by IP address not web site so I will be Googling em one at a time..

I am stumped at the moment. I don't knowingly sync anything, but it's strange that it appears to have started bang on 19:00 Sunday evening.

[/URL][/IMG]

DampDog · 16 Jun 2014 at 21:42

No, not running any of those. Don't download any films/TV. That's why I'm mystified. Only thing I have that has downloaded any large content is Steam. But not added anything for months and what updates I've seen have been small.

DampDog · 17 Jun 2014 at 07:32

dougal1331 said:
Can you use your firewall to block the specific IPs? You may be able to blacklist them in the router hub settings too.

Not sure I will have a look. Coincidently my virus software (McAfee) is due for renewal this week, so I might look for an alternative that will.

I'll have to sit and wait and see if it does it next Sunday evening. I'll clear the logs beforehand to narrow down it down. Something must be triggering it, either some app that I'm not aware of or something external. It has got me scratching my head as to what it might be. If I can't isolate it, I'll have to bite the bullet and do clean install.

DampDog · 17 Jun 2014 at 08:06

cheesyboy said:
My wife's android tab was syncing her entire outlook email history, which was filling the tablet's 'cache' to the extent the storage was filling up; I kept clearing the cache and it kept filling up, before I realised the cause. We were getting around 50GB per month of downloads in excess of what I expected.

Possible you have similar?

Only machine I email from is my desktop. Plus I'm an old git and still have that set to POP3, so don't sync as such.

DampDog · 17 Jun 2014 at 15:05

KIA said:
You can use Resource Monitor to view detailed network activity.

http://www.pcworld.com/article/241677/how_to_use_resource_monitor.html

Cheers for the link

Following on from Sunday, I've already primed myself as best I can, I've already downloaded a usage monitor from the Think broadband site

http://www.thinkbroadband.com/tbbmeter.html

And now have a shortcut setup for the resource monitor; that said I've had it running in the background anyway while trying to pin it down.

It's just an odd one. It's a way bigger download than anything I've knowingly downloaded. Plus normally when the download is that large I'd expect a progress alert of at least a hint of what the download may be. But I can't find a trace of it and saw nothing while it saw downloading. Been scratching my head at to what it may be but clueless so far.

DampDog · 17 Jun 2014 at 16:32

tipes said:
Are you using wireless or Ethernet connection? If you are using wireless - maybe one of your neighbours is using your bandwidth to download stuff. If you are using wireless make sure it is using encryption to stop others stealing.

Just a thought

That has already crossed my mind. I am encrypted but I changed wireless key and Admin password just in case. Even unsubscribed from BT-Fon, for good measure.

I had a look at the 2 tablets I have via wireless and checked their usage log for the past month and they are both minimal.

DampDog · 17 Jun 2014 at 16:59

AtaRo said:
Install Comodo Firewall and open Active connections window as it will list all the apps that is connected/listening to the net, it will also display its usage, so when the unknown download starts you will be able to see what apps is doing it.

You can only do this to the pc to which you think is doing the unknown download or where the Comodo Firewall is installed.

Cheers, might have a look at that. Sods law my McAfee subscription runs out tomorrow so I'm look for something anayway.

Diagro said:
Do you have anyone connected to the hub via BT Wifi? dunno if that would matter

No, desktop PC is connected via Ethernet, and just 2 tablets via Wifi. And I've checked their usage.

DampDog · 17 Jun 2014 at 17:25

Quartz said:
Are these downloads or uploads?

How secure is your wifi?

Download.

I don't have any additional Wifi security other than the standard encryption and using a pretty long/complex Key.

DampDog · 17 Jun 2014 at 18:15

Bane said:
Could always try BitDefender freebie or Avast freebie or one month trials of the paid for packages to see what you like.

Worth checking your bank to see if they offer free antivirus, as Barclays provide Kaspersky and HSBC offer McAfee for example.

BitDefender looks like it's on promo at the moment. (1Year X3 licenece) £29.95 Don't think I'm allowed to post the link here, think it's against the rules.

I'm with Natwest they just provide Rapport for free.

DampDog · 18 Jun 2014 at 07:44

Quartz said:
Have you disabled WPS on your router? Because that's been cracked.

No I'll have a look at turning it off. When you say it's been "cracked" do you mean WPS is generally no longer a secure connection method. Or you think my connection has been??

I've already changed my Wifi key and admin password as a precaution.

DampDog · 18 Jun 2014 at 08:14

Cheers for that. I'll have a look at disabling it.

DampDog · 22 Jun 2014 at 20:48

Well little update for all those who were kind enough to help.

I've addressed a couple of the suggestion posted. I've disabled WPS and connected all my Wifi devices manually with new passwords. Secondly over the course of the week, updated any and all my installed programs and disabled "auto-update" on what I could.

One thing that I did notice is that McAfee has an inbuilt vulnerability scanner that checks for newer versions of installed programs. The only thing it flagged was Skype was not up to date, however when I tried to update it, it failed. I ran the update manually form Skype and it took 2 attempts before it was successful.

Anyway sat this evening and waited for it to start again but it's absolutely fine. However I did see Skype auto-update pop up and then disappear. (even though auto-update is set to off)

The only thing I can think of as a possibility, is Skype attempted an auto-update "failed" and got stuck in a loop continuously trying to download the update. Hence 7.5 Gig in one go. (I've only used just over 2Gig all week)

Thanks for the advice/help. I'll keep an eye on it for a while just to make sure it doesn't happen again.

DD