Whats using my internet connection?

[high]

Hi all...I'm a pc tech and all but I have a weird problem. Something is running in the background using bandwidth, and I'm assuming it's spyware. I have run numerous spyware apps, etc...and checked msconfig + ctrl+alt+del for running processes and nothing looks unusual...how can I see what prog is using the bandwidth?

 

[biostud]

install a firewall

 

[high]

any other brilliant advice?

 

[Schadenfroh]

let us see your hijackthis log

 

[Firus]

Originally posted by: high
any other brilliant advice?

Actually this is good advice, it would instantly tell you what applications are trying to go out to the internet. A little quick to snap aren't we?

 

[SpunkyJones]

Originally posted by: biostud666
install a firewall

Seriously, do this, its good advise.

 

[high]

I obviously have a firewall installed is what I meant. Anywho, here is my hijackthis logfile:

Logfile of HijackThis v1.98.2
Scan saved at 7:01:32 PM, on 11/22/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\system32\ctfmon.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NetLimiter\NetLimiter.exe
D:\Valve\Steam\Steam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\WinRar\WinRAR.exe
D:\WinRar\WinRAR.exe
C:\DOCUME~1\Mike\LOCALS~1\Temp\Rar$EX00.500\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

 

[Crusty]

YOu can also install NetLimiter and that will tell you what is connecting to where.

 

[gsaldivar]

Sorry man, I'll be done in a bit.

 

[naddicott]

Steam uses your internet connection intermittently (checking for updates, etc.), at least on default settings it does...

Btw, according to the HijackThis, he already has NetLimiter running.

 

[LordPhoenix]

Firewall+AV+Firefox+AdAware+Spybot+/-.

 

[high]

thats what I've got installed

 

[crazycarl]

about how much bandwidth are we talking here?

 

[JonnyBlaze]

type 'netstat -a' at a command prompt and you can see where your connected too. then you could modify your hosts file to point that location to 127.0.0.1 untill you find what process is the cuplrit. also, some spyware programs are installing themselves as services. check for anything that dosent look right.

JB

 

[AFB]

Ethereal