Is my PC sending out Spam...?

[Arnold Rimmer]

Guys, I thought I would ask the question in case somebody has any good advice. I have just installed a new Netgear wireless router and in the advanced features I can take a look at traffic in and out. The PC (Win 7 Premium) has become noticeably slow and unresponsive lately (not unusual I know sometimes) but checking the outgoing traffic I saw about 150Mb had gone out in about 90 minutes when the PC was idle. I have ESET AV installed and up to date, but I'm beginning to think something malicious has slipped in unnoticed. Even before I changed the router performance was slow.

I'd appreciate any advice on how to scan for something nasty as ESET hasn't picked anything up.

[Update] Data seems to be uploading at about 70Mb an hour.

 

[TriplexDread]

Have you ran all the usual scans in safe mode (no network?)

 

[Arnold Rimmer]

I'll have to check that, thank you Triplex. There is a MacPro, a MacBook Pro and 2 printers connected to the same gigabit switch as the PC in question and from that switch to the router. I have tested just both Mac's and they are not responsible. I have disconnected the network cable and scanning now - might take a while, but will report back, thanks again.

I recently installed CrashPlan to back everything up in case of failure and they send out an email occasionally telling you how well it's done, I wondered if it was uploading any data as in syncing or something?

 

[Arnold Rimmer]

Scan complete, nothing found.

 

[TriplexDread]

Hmmm strange. Can't think at present. I used to use a piece of software called Solarwinds, it allowed full monitoring of bandwidths and IP's. Have a look for it, maybe a trail version?

I'm sure someone else can suggest something?

 

[Arnold Rimmer]

Hmmm strange. Can't think at present. I used to use a piece of software called Solarwinds, it allowed full monitoring of bandwidths and IP's. Have a look for it, maybe a trail version?

I'm sure someone else can suggest something?

Thanks Triplex. After re-connecting the PC another 65Mb went up in the last half an hour.

 

[Arnold Rimmer]

Yes Solarwinds looks good stuff, but not sure it will scan a PC for anything cunningly hidden will it unless I've missed something. Thank you for your replies, much appreciated.

 

[Arnold Rimmer]

On the Mac you can get an app called Little Snitch which lets you control who or what your machine talks to. I wonder if something like that will identify where this data is going, then you can prevent it.

 

[EvanDavis]

What software are you using to scan for nasties ?

 

[Arnold Rimmer]

ESET NOD32 latest version. I hope this is good enough, just signed up for 3 years....!

 

[Ian]

NOD32 is very good .

If you've got crashplan installed, I'd assume it is that sending data, as it'll need to backup data regularly to keep in sync.

What you could do is run something like CurrPorts to see what your PC is doing while data is being sent (similar to the tool TD suggested I guess): http://www.nirsoft.net/utils/cports.html

 

[V_R]

From what I've just read I'd say its almost certainly Crashplan. Its a cloud backup and guess what? Its backing up to the cloud.

 

[Arnold Rimmer]

From what I've just read I'd say its almost certainly Crashplan. Its a cloud backup and guess what? Its backing up to the cloud.

Well that's interesting...I thought I was backing up to a connected USB drive which is how I had configured it. We have a rubbish broadband connection thanks to BT, so I opted for a local backup (Drive F). I might try uninstalling CrashPlan and test the traffic then. Thanks chaps for your continued support.

 

[Arnold Rimmer]

From what I've just read I'd say its almost certainly Crashplan. Its a cloud backup and guess what? Its backing up to the cloud.

I've uninstalled CrashPlan and the uploads have stopped, so we have a result. Can anyone recommend some good backup software for local backup only so in the event of drive failure one can Restore it to a new drive?

 

[V_R]

Personally I use copy and paste/drag and drop (call it what you will), to an external drive. Never bothered with any backup software.

Windows and a few other bits on an SSD, so if I need to reinstall the OS I don't loose all my documents which are on a separate drive, as are my steam games on another separate drive.

USB external drive, copy and paste, every week or so *usually*. I also do it via remote while I'm at work, that way I don't have to faff when I'm at home!
.

 

[Arnold Rimmer]

Personally I use copy and paste/drag and drop (call it what you will), to an external drive. Never bothered with any backup software.

Windows and a few other bits on an SSD, so if I need to reinstall the OS I don't loose all my documents which are on a separate drive, as are my steam games on another separate drive.

USB external drive, copy and paste, every week or so *usually*. I also do it via remote while I'm at work, that way I don't have to faff when I'm at home!
.

Yes, I wondered about copy/paste etc. Because our broadband speed is so atrocious, I think as long as drag&drop picks up things like Outlook emails etc., and also Steam games I'd be happy. I just know from experience of Windows copy/paste - drag&drop doesn't always work does it or am I wrong there? There always seems to be an error message or missing .dll files etc ...!

Worth a try though. Would copy/paste C drive make it bootable?

 

[V_R]

Like I said, I don't backup windows, just my docs etc. I don't have errors about files like that.

Would copy/paste C drive make it bootable?

No, there's more to it than that. You would need to clone the drive.

 

[Arnold Rimmer]

Like I said, I don't backup windows, just my docs etc. I don't have errors about files like that.


No, there's more to it than that. You would need to clone the drive.

Gotcha, thanks V_R, I suppose the most crucial backup would be of Outlook emails and accounts. Where are they located on C (Win 7 Premium) and can they be copied by drag&drop? Thanks...!

 

[V_R]

Who is your email with? If its Google or similar you could just resync them?

PST locations: https://support.office.com/en-ca/ar...ta-files-0996ece3-57c6-49bc-977b-0d1892e2aacc

 

[Arnold Rimmer]

I use the POP server under my domain. Thanks for the link V_R perfect.
Thanks to all for helping.