Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My ISP suspended my IP today because they spotted spam activity from this network last night at 3 AM. I leave this computer on over night. I want to know if there a quick way to detect if this computer is the culprit?

share|improve this question
Lots of other questions here on that subject take a look at some of the answers to them. For example… – Brad Patton Mar 20 '13 at 2:39
You already know. The ISP told you. – Ярослав Рахматуллин Mar 20 '13 at 7:45
Do you have more than one PC on the network? – AthomSfere Mar 28 '13 at 0:15

There are a few things you can do:

  1. Run a malware/virus check. Something along the lines of Malwarebytes or something similar.

  2. Run a packet capture (or get traffic with WireShark using a laptop or something as a replacement of the router, and see what traffic is being sent to the gateway.

  3. If your router provides it, look at the connections from the PC, and see if it is abnormal.

share|improve this answer

A quick PARTIAL check could be to leave your computer on with web browser etc loaded on a simple page - like google, and make sure you are not using anything (like no mail checks).

Check to see the lights on your modem to see if they are flashing. Particularly if the LAN light on the port connected to your computer flashes quite a bit - and the WAN or PPP port as well.

This will tell you if traffic is leaving your computer.

(As indicated, this is a quick rough and ready check to give you confidence or confirm a suspeicion, its not meant as an alternative to BriGuys solution, and false positives and negatives are possible - for example if your machine is doing something legitimate you arn't aware of or if its scheduled only to active at certain times)

share|improve this answer
Traffic in its-self is not a sign of a virus. – N4TKD Mar 20 '13 at 9:04
Correct, but traffic when there should not be any is. If your ethernet light is blinking hard out and you are not doing anything on your computer it warrants further investigation. I did say it was a PARTIAL check, and also FALSE POSITIVES and NEGATIVES are possible. – davidgo Mar 20 '13 at 19:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .