0

I'll try my best to explain. I was on a rush today, so I downloaded something from a source I didn't know. I didn't double check (yep, my bad) and run the executable.

I didn't explicitly run it as an administrator mode, but the User Account Control window asking Do you want to allow this app from an unknown publisher to make changes to your PC? popped up (so maybe that message means the app is asking for admins? if that's the case RIP me).

So I clicked Yes and the problem began. When that PC is connected to the WiFi, every other PC gets a ping response of over 200ms to the gateway router 192.168.1.1 and a 200ms to 1.2s to 8.8.8.8. Subsequently, by running speedtest.net said PC gets a download speed of about 1 Mbps while the other 2 PCs and 1 Mac gets 6 Mbps.

Obviously something in my PC is eating bandwidth. Problem is I'm unable to track it down. The Task Manager doesn't show any process with a high network consumption nor the Performance shows 0 Kbps send and received.

I'm using Avast antivirus which didn't find anything after a full system scan.

I ran out of ideas, how do I track down this thing?

EDIT: did a system restore for one of 3 days ago. Made no difference.

Improve this question
11
  • how about sysinternals process explorer used to view the process that is using network bandwidth (look it up how to use it for that)
    – barlop
    Jun 1, 2016 at 0:48
  • In addition to the sysinternals tools, look at your router logs too and confirm that it is indeed that IP that has lots going on with your data network. You could also run Wireshark and trace all TCP/IP running on the machine and see what's going on.
    – Vomit IT - Chunky Mess Style
    Jun 1, 2016 at 1:03
  • worth noting that wireshark won't show process name
    – barlop
    Jun 1, 2016 at 1:05
  • Also, it might be more malware than a virus. My guess is that the software changed your registry in some way to automatically let it run. Try some other anti-malware software as well. Typically no single malware solution captures them all. If you have a previous version of your registry it might be worth rolling back to that if possible.
    – Dale
    Jun 1, 2016 at 1:10
  • @Dale you write "Also, it might be more malware than a virus." <-- what do you mean? I'm not sure that proper Viruses are really written anymore. Where you find multiple files get infected by the thing as it copies itself and 'multiplies'. So if you distinguish virus from malware and presumably you don't mean a virus in the sense of infecting lots of executables, then how are you defining virus?
    – barlop
    Jun 1, 2016 at 1:40

1 Answer 1

Reset to default
1
  1. Start Task Manger (Ctrl+Shift+Esc)
  2. Select the Performance tab
  3. Click the Resource Monitor... button at the bottom of the tab
  4. When Resource Monitor starts click the Network tab
  5. Investigate all the Processes with Network Activity to locate the offending process

If you are unsure about a particular process you can right click on it and Search Online for more information on that process:

enter image description here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .