Troubleshooting possible virus

[Zarathustra]

I just got a call from the cable company. They told me that in the last 48 hours, nearly 8 GB has been uploaded from our broadband connection. Here we go.

I've got the router locked down pretty tight--MAC address filtering, encryption, hiding the network ID. I'm running Norton Internet Security 2008. I've checked my logs, and I don't see that much data being uploaded from my computer. I'm going to check the others, too.

So if I find the log of the data being uploaded, what then? If I don't find a record of that data being sent from any of our computers, does that mean that someone is hacking into my wireless router?

How would you guys go about troubleshooting this? We're running full system scans on the computers right now, as the first step. One computer so far came up clean.

[[Syl]]

I take it you didn't notice any change in performance on any of your computers? That's a fair amount of BW for 48 hours (if you have comcast, that would put you at about half of their monthly cap if it was sustained), so if not, I think I might ask the company to recheck their records.

First, open up your router software ( 192.168.1.1 ). There should be a tab to check out all devices that are connected. If you see any you don't recognize, I'm pretty sure there's an option to block them. Then to be safe, change the password. Oh, and make sure the encryption is on. WPA or WPA2 if you have it. (or not. totally missed that para, sorry)

After that, I'd check the task manager to make sure there aren't any processes or applications using a lot of memory that shouldn't be.

Are you using a firewall (windows firewall doesn't count ). I'd put it on max and make sure you know every program that's allowed. As long as you're not running vista, there's also another layer of protection you can add with peerguardian, though I haven't seen an update in weeks. Not sure how effective it would be for this kind of problem, but it couldn't hurt.

If your virus scan doesn't turn up anything, you could try going to a recent system recovery point if you have one.

All I can think of off the top of my head (other than router filter stuff that you have to buy, as far as I know). Hope someone's not uploading kiddie porn on your net, man.

[Cail]

Holy shit, people can do that?

[[Syl]]

Yeah. A lot of people just leave their wireless router with the default settings, basically turning their home into a free hotspot for the neighborhood. And if someone doesn't want that traced back to them...

[Cail]

Holy crap......

[High Lord Tolkien]

Anyone in the house addicted to myspace?
At the last company I worked at our receptionist was a myspace and face book addict.
She showed up on my bandwidth use charts like a supernova!
I guess because there's so much content on each page including music and the fact that it constantly refreshes itself burns alot of bandwidth.
She herself typically used 1 GB in an 8 hour shift and didn't down or upload a thing.
Also internet radio is a huge bandwidth killer too.
I'd investigate online gaming too, but I know nothing about how much bandwidth that uses.


Sorry, you said "uploaded" i missed that.
I don't think what I said applies to uploading.

[wayfriend]

Once a program is running on your box, all your wireless router protections are for nothing.

Review your internet security settings, the list of programs allowed to connect. And then make sure that those programs haven't been tampered with - check the file dates.

Norton internet security doesn't have virus protection IIRC. If you're not running with virus protection, then this leaves an opening. Try to get a virus scanner running.

Also, review anything you've installed recently for spyware. (just google program-name + "spyware".) Free software is often not as free as we'd like.

[Zarathustra]

Syl, I haven't noticed any performance problems with the computers, or surfing. But I don't download or upload much anyway. I will ask Insight to recheck their records when they open tomorrow.

I've opened the router software, but when I try to input my password to access the logs and info, I get a warning that I'm sending my password over an unencrypted connection, making it very easy for third parties to see it. I don't understand that, because encryption is on. Besides, I'm sending it directly through my LAN cable to the router, so how can any third party see my password? Are they talking about viruses on my PC?

I don't remember being prompted with this warning in the past (in fact, today, it didn't give me this warning). I changed my router password just to be safe. But if the info is sent over a connection that's not secure, that action could have been easily seen, too.

First, open up your router software ( 192.168.1.1 ). There should be a tab to check out all devices that are connected.

No tab, but I can check the DHCP client list. The only computers on it are our own. Names and MAC addresses check out.

Encryption is on. WPA-PSK. Encryption technique is TPIK. And I've got a big ass pre-shared network key.

I didn't seen any processes or applications using a lot of memory that shouldn't be. I did download Process Explorer (an advanced version of Task Manager) from PC Magazine link, but it has so much information, I don't really know where to start.

I'm using both a hardware firewall (Belkin router) and my Norton Internet Security 2008 firewall. I'm not sure how to "put it on max." It's fairly automatic and in the background.

My step-son's computer was a gift from his father. I just learned last night that it's not a strictly "official" copy of XP he's running--it's a copy of his father's. So he has all Windows updates turned off. I told him from this moment on, he can't use his computer online until we get him a legit copy of Windows.

What I want to know it this: how can I check the network traffic in the last 3 days? Why isn't there an easy way to do this? I just want to know how much data has been uploaded from each computer on my network, which program uploaded it, and what the destination was. That way, I can confirm if the cable company is correct, and where exactly the problem is.

Why isn't there an easy way to check this in my router? Or on the computers themselves? Wouldn't that immediately tell me if the problem is a virus on one of our computers, or if someone is hacking into my wireless router?

I'm thinking of getting a new router. They are cheap. I'm thinking I need one that does WPA2.

Review your internet security settings, the list of programs allowed to connect. And then make sure that those programs haven't been tampered with - check the file dates.

I'm not sure how to do this. I could do it easily with my previous version of Norton's. But now everything is so damn "hands-off," when I click on my firewall, all it does is give me a little box that says, "Firewall is on and working properly." I don't surf on my PC's admin account, so I'll have to log off and see if I can dig deeper on that user account.

Norton's Internet Security does indeed have antivirus, antispyware, etc. It got PC Mag's highest rating this time around, beating our even Zone Alarm. I scan all the time, and the automatic update is on ensuring I have the very latest virus signatures.

I'm very careful what I download, never downloading anything free unless I know for sure it comes from a trusted source. Now my son, that's a different matter. He says he never downloads anything, but he does play free online games (Flash games, etc.). He uses Myspace, but doesn't upload much to it. He doesn't do peer-to-peer music sharing, but he does have a Zune and uses the official Microsoft Zune Marketplace.

[wayfriend]

I've opened the router software, but when I try to input my password to access the logs and info, I get a warning that I'm sending my password over an unencrypted connection, making it very easy for third parties to see it. I don't understand that, because encryption is on.

This means that you are not using HTTPS (secure HTTP) to connect from your browser to your router. It doesn't have anything to do with, or have any way of knowing, that the connection remains internal to your wireless LAN, and that that is encrypted at a lower level. (If it went outside your LAN over the cable modem to the universe, then the warning would pertain.)

In other words, this is a non-issue.

What I want to know it this: how can I check the network traffic in the last 3 days? Why isn't there an easy way to do this?

Normally traffic statistics such as this are not maintained. And even if they were, it's usually something that must be turned on before getting the statistics. Same reason for both: because it's very laborious for a computer to update a database every time a network message is sent.

About the best thing you can do, as Syl says, is look for strangers which are assigned IP addresses in your LAN.

If you really want to, you can get some freeware sniffer software, like WireShark, and have it start capturing all traffic on your computer. But, as I said, that won't go back into the past.

However, I suspect that this is not the case. It's almost impossible to break into an encrypted LAN. It's much more likely that you've gotten something installed on your computer which is generating activity. Such code uses the connection your computer already has, and so all the LAN securuty in the world doesn't stop it.

Review your internet security settings, the list of programs allowed to connect. And then make sure that those programs haven't been tampered with - check the file dates.

I'm not sure how to do this. I could do it easily with my previous version of Norton's. But now everything is so damn "hands-off," when I click on my firewall, all it does is give me a little box that says, "Firewall is on and working properly."

I have Norton Internet Security. There is a way to get to the list of allowed/blocked programs. You just have to hunt around. The "hands offishness" (which less experienced users appreciate) usually means you have to hunt around for the advanced settings, but it doesn't mean that they aren't there.

Norton's Internet Security does indeed have antivirus, antispyware, etc. It got PC Mag's highest rating this time around, beating our even Zone Alarm. I scan all the time, and the automatic update is on ensuring I have the very latest virus signatures.

Ah, well, then that's something to cross of the list.

One other suspect I would mention is that you have some normal piece of software, operating normally, that is doing something you didn't anticipate. Sometimes at the end of these quests, you end up with "duh" for the answer.

[Zarathustra]

Thanks for the help the guys. If I ever find out the problem, I'll post the results for future reference. I'm going to call the cable company today.

[High Lord Tolkien]

Now my son, that's a different matter. He says he never downloads anything, but he does play free online games (Flash games, etc.). He uses Myspace, but doesn't upload much to it. He doesn't do peer-to-peer music sharing, but he does have a Zune and uses the official Microsoft Zune Marketplace.

"Now my son"...warmer....."he does play free online games"....BINGO!

Did any other IT people just shudder a little reading that last quote?

Every time someone comes to me with a computer problem 9 times out of 10 it eventually goes back to "my son plays online games".
I suspect your son's pc/laptop is polluted with legitimate programs that don't show up on scans.
Plus I suspect your son is also lying to you after how you reacted to that kid messing with your car.

[Zarathustra]

Now my son, that's a different matter. He says he never downloads anything, but he does play free online games (Flash games, etc.). He uses Myspace, but doesn't upload much to it. He doesn't do peer-to-peer music sharing, but he does have a Zune and uses the official Microsoft Zune Marketplace.

"Now my son"...warmer....."he does play free online games"....BINGO!

Did any other IT people just shudder a little reading that last quote?

Every time someone comes to me with a computer problem 9 times out of 10 it eventually goes back to "my son plays online games".
I suspect your son's pc/laptop is polluted with legitimate programs that don't show up on scans.
Plus I suspect your son is also lying to you after how you reacted to that kid messing with your car.

Yeah, I had a similar reaction about the games thing. I once worked at a call center (we did tech support for the Onstar call centers around the country) where people had lots of free time between calls, especially on the night shift. The ones who played online games were always the ones being infected with malware, spyware, etc. They kept our support guys busy. I don't know why they didn't lock that down.

Anyway, I made it clear that it was *vital* that he told us everything he was doing, since both Ki and I work from home, and our Internet provider would cut off our Internet if this kept happening--threatening our livelihood. Even if it's porn (though that would be downloading, not uploading). No matter how embarrassing, I told him.

But I do think you're on to something, which is why I've cut him off from the Internet. If it's his actions, or his illegitimate copy of Windows, we would have the indirect evidence of the traffic spikes halting, and have a good idea that we've isolated the problem to his computer.

I have a hard time believing a hacker would be stupid enough to call attention to himself by uploading so much data through our connection that it would get the attention of the cable company itself. Wouldn't our ISP have records of where that data was going? The lady who called said they only had records of the amount, not the destination. That, too, is hard to believe. I bet if it were some child porn, they'd come up with the destination real quick for the government!

[wayfriend]

I have a hard time believing a hacker would be stupid enough to call attention to himself by uploading so much data through our connection that it would get the attention of the cable company itself.

That's the nutshell of the heart of the issue.

Viruses that zombie your computer DO upload massive amounts of data.

... and that's exactly the reason why your ISP reviews your records and checks for suspicious changes in upload behavior.

See en.wikipedia.org/wiki/Zombie_computer

Wouldn't our ISP have records of where that data was going? The lady who called said they only had records of the amount, not the destination. That, too, is hard to believe. I bet if it were some child porn, they'd come up with the destination real quick for the government!

This isn't like phone calls. If your phone company had to keep a record of 1 billion phone calls from every customer every day, they would NOT keep a record of them. That's the analogy to what you ask for.

However, just about everything in an ISP has a use counter. It simply increments a count of each packet sent or received. This allows them to charge certain customers based on use, and so it means money, and so is implemented.

It may be that they can turn on something to start collecting such data as you ask. But chances are one iggly piggly home customer is not worth the overhead of such a service.

(And that's not how they catch child porn posters anyway.)

If you really want to go that way, download WireShark, start capturing all traffic on your LAN while no one in your family is doing anything, leave it on for a day or so, and see what happens.

[Zarathustra]

If you really want to go that way, download WireShark, start capturing all traffic on your LAN while no one in your family is doing anything, leave it on for a day or so, and see what happens.

Good idea. I'll do that. So you're saying leave the computers on, but don't do anything? Activities unrelated to the Internet would be fine, right? I suppose we could do that over the weekend, when we're not working.

Or are you saying turn the computers off (at least the ones not running the software . . . no wait, that wouldn't make much sense . . . .unless this is software for the router itself . . . I'm confusing myself), leave on the router (which is always on anyway)? Or try both?

Does everyone else leave on their router overnight? Mine doesn't have a power button. So unplugging it is the only way to turn it off. I suppose I could block traffic on it each night when I shut down my computer. I could also just unplug the CAT5 cables, but that's a pain too.

[wayfriend]

[ Didn't I post a response to this? I thought I did. Well, if there's two responses later, don't blame me. ]

If you google "is my computer a zombie" you may see lots of tactics that are more straightforward that capturing all your network traffic and trying to find unusual activity. I would say that this course is a brute force approach that's suitable for a last resort. Or if your just darned curious.

Wireshark is a Windows (or Linux) app, so that computer needs to be running.

I would leave your other computers up if you want to see if they are zombies.

You may want to verify that you can capture all LAN traffic before you commit yourself. That is, you can see other computer's traffic.

Then, yes, leave all the computers on, and don't use them yourself. The hard part at the end is pooring through lots of data to find anomolous traffic. The less valid traffic that there is, the more the anamolous data will stand out. So this just makes it easy for yourself. (And there will always be valid network traffic, even on an idle system.)

I can't tell you where to go from there, except look for lots of outbound traffic going to the router modem.

And yes, everyone leaves their router/modem up all the time, usually, AFAIK.

[Cail]

You guys have me totally paranoid now, so I'm crediting something weird with my laptop as being a virus (or cooties).

For most of the last two years, my laptop has been used exclusively with either a Sprint or Verizon aircard. Only in the last 2 months has it been on a secure wireless network. I run McAfee security with the Windows firewall. I regularly use CCleaner and AdAware. According to everything I have, my system is clean.

But....

Stuff has disappeared off my desktop. My volume control, the "eject hardware" icon, and the little computer icon that shows up when I VPN into work have all vanished. Then there are the times when my hard drive just spins like crazy.

So tonight, I tried to do a system restore.....No go. It won't restore to any point I tried.

WTF?

[Avatar]

When I lose things like my volume control, it's usually because of some sort of hardware conflict/error, often with a game or other program. But they usually come back with a restart. Can try making sure you have the latest drivers, or reinstall the soundcard.

The little network icon might be as simple as telling the network connection to display it's status, especially if you've moved to a new network connection...just go to your network properties, and check the "show icon in notification area" box in the general properties of whatever network you're using.

HD spinning randomly? Might be indexing...do you let the inbuilt "findfast" run? That indexes your HD regularly for "faster" searches, but causes random slowdowns while running...personally, I turn mine off.

(I always turn off my system restore archiving...never ever seen one of those work properly...when I restore my system, I do it the old-fashioned way...reinstall windows. )

--A

[Cail]

It's a laptop, so I shut it off every time I'm done with it.

I'll play with it some more tonight, but I'm really concerned about it not being able to restore.

[High Lord Tolkien]

You guys have me totally paranoid now, so I'm crediting something weird with my laptop as being a virus (or cooties).

For most of the last two years, my laptop has been used exclusively with either a Sprint or Verizon aircard. Only in the last 2 months has it been on a secure wireless network. I run McAfee security with the Windows firewall. I regularly use CCleaner and AdAware. According to everything I have, my system is clean.

But....

Stuff has disappeared off my desktop. My volume control, the "eject hardware" icon, and the little computer icon that shows up when I VPN into work have all vanished. Then there are the times when my hard drive just spins like crazy.

So tonight, I tried to do a system restore.....No go. It won't restore to any point I tried.

WTF?

One thing to remember about anyone hacking into your wireless connection is that they can't (well, anything is possible but it's very unlikely compared to the ease of surfing off your wireless) mess up your laptop.
I we lived next to each other and my laptop could "see" the signal from your house I could connect to it and surf off it, if it wasn't password protected. But I couldn't gain access to your operating system. It's harmless and you'd never know it until Comcast called you like they did Malik about bandwidth use.
Think of it as hacking into your aircard not your laptop.

[stonemaybe]

Here's a really good website for these type of things...

www.daniweb.com/

The forums are great.