Mystery uploading of data

[sastek]

Hi all, I've noticed that my PC is uploading data to somewhere when it shouldn't be, yesterday it was about 110MB, but other days it has been over 100MB an hour.

Could someone please guide me on how to find out what is going on with the PC and where the data is going?


Thanks
Stu

 

[TGSoldier]

Hit the Start button. In the search bar type Resource Monitor to see what is uploading the data

 

[sastek]

Thanks for the reply, I've never actually caught it in the act yet, hopefully I will sometime soon.

 

[whs]

The OS is constantly sending data to Microsoft. I suspect that it is one of those.

 

[Faladu]

What data is getting sent to Microsoft? constantly?

 

[NoelDP]

Very little data gets sent to MS - mostly it's crash data, and is only sent after you've approved it. (although it's possible to 'bulk-approve' certain kinds of data).
It's certainly nothing like 100MB a day, let alone in an hour!

Have you checked for malware on the system? rootkits? - those sort of numbers could easily imply that your machine has been booted, and is pouring spam out into the net.

 

[sastek]

Hi, I've checked for malware/rootkits etc but found nothing.

Today I caught it in the act, 777MB uploaded. I looked in Resource Monitor and TCPView and found a connection to IP 63.141.242.11, I can't remember exactly what it said, I think it was "ms-wbt-server" which has something to do with Remote Connections. I dashed into Services and stopped Remote Desktop Services, this killed the connection.

It looks like someone has found a way to connect to my PC through Remote Desktop/Assistance or something and was sucking my data.

Is there any logs that I can check to see exactly what was going on?

 

[NoelDP]

63.141.242.0 - 63.141.242.47 - Lookup Ip, USA