[WXC/VFX] Data loss anyone?

Forums › One NZ (including Farmside) › [WXC/VFX] Data loss anyone?

machealer

4 posts

Wannabe Geek

#29186 28-Dec-2008 09:27

Hi, I seem to beh aving some issues at Xnet where my data usage has gone through the roof yet Im not doing anything that would acount for it..

I dont watch many movines, dont do filesharing yet somehow I chew through 9 gigs of data a month...(yes I need to keep upping the limit else it slows down to slower than dialup)

I do not that XNET seems insecure.. when you log into your account it sends your password unencrypted.. Why would XNET not use even basic security? I guess one possible explanation is a person has got hold of my login and has been downloading against my account? (this is based on a security program warning my my password was about to be sent to this site, which it would not usually do if it was encrypted)

Speaking to Xnet helpdesk was very unhelpful.. It was pretty bad customer service. I was told well we can run a report to show where data was going, but it will cost you $50.. i think the guy said something like, its not their responsibility if I have an insecure system.. which I dont. (wired NOT wireless, auptodate antivirus/firewall, spyware x a few and updated op system patches)

Suffice to say I have changed my password, but since they have full visibility of what that password is, and dont use encryption.. what good will that really do?

has anyone else found issues like this? what else can one do.?

[Moderator edit (MF): moved to correct forum]

1 | 2

1202 posts

Uber Geek
+1 received by user: 3

Trusted

#186362 28-Dec-2008 12:59

Could be a whole bunch of things. Can you turn on traffic logging on your router? The Netgears allow you to monitor what the traffic is and where is it going by changing the firewall rules.

You can also type netstat at the command line on each machine to see where traffic is going.

How many devices do you have on your network? Just your PC?

Do you run any servers?

You should also download the XNET Usage Monitor, it sits in your tray by your clock and shows you what data you are using, be it local, national or international traffic.

http://www.xnet.co.nz/usagemonitor/

Also, if you get a traffic monitoring program from www.download.com something like NetMetre or WatchWAN would be good you can see what traffic is being generated to each PC and where it's going.

Tyler - Parnell Geek - iPhone 3G - Lenovo X301 - Kaseya - Great Western Steak House, these are some of my favourite things.

Niel

3267 posts

Uber Geek
+1 received by user: 80

Trusted

#186363 28-Dec-2008 13:11

Any chance you installed something like Metacafe Pro? It is an alternative for YouTube and even though you do not watch much it still downloads videos before you watch it and then distributes it to other people that also wants to watch it. Even when you quit the program, the service still runs in the background.

There is no need for encryption, because you can have only 1 ADSL login at any one time. If someone else is using your login, then your connection will be disconnected.

Log into your account from the XNet home page and view your internet usage, it will show when the data is used and if at that time all your PCs are turned off then you have proof that there is something wrong on XNet's side. Until then, there is nothing they have to do.

Running a log of your internet usage is a big job, I am not surprised that it will cost $50. Sure the system can generate a log, but image the size of that log!

In almost 2 years I have never had unexpected increase in data usage, and I monitor it closely.

You can never have enough Volvos!

machealer

4 posts

Wannabe Geek

#186366 28-Dec-2008 13:57

thanks for the advices, I have a dynalink router and I dont believe it supports logging, I have the usage meter and It does seem to increase more than I would have expected. Interesting that only 1 adsl connect is supported so that discards one theory.

Ill look for those logging programs.

Net stat shows 14 active connections.. what is about normal?

I dont run any servers, there are 4 PC's (2 for kids - , 1 for partner)

Cheers

kerrin

165 posts

Master Geek
+1 received by user: 4

#186370 28-Dec-2008 15:25

machealer:
Speaking to Xnet helpdesk was very unhelpful.. It was pretty bad customer service. I was told well we can run a report to show where data was going, but it will cost you $50.. i think the guy said something like, its not their responsibility if I have an insecure system.. which I dont. (wired NOT wireless, auptodate antivirus/firewall, spyware x a few and updated op system patches)

Unfortunately I'm not at all surprised you've found xnet support to be less than helpful.   Once apon a time they would have happily helped out...

Niel is correct, your connection would disconnect the moment someone else tried to logon as you, so I would concentrate on either your PC or router. Xnet are most likely correct that your end is insecure somehow...

I notice you mention you use a wired connection - does your modem/router support wireless? - if so, have you checked that it's been secured (or better switched off). i.e. it's not being connected to by one of your brasher neighbors...

Next thing would be to setup some local monitoring to find if you have some stealth software installed that's using the data.

Alternatively you can run a couple of simple but time consuming tests using xnet's on-line usage meter (xnet website account section):

1. Check your connection:
Record your usage, then shutdown your PC, but leave your modem/router on. Check back much later on usage.
Any change illuminates your PC, and therefore suggests that someone is either using your wireless, or an xnet accounting error is occurring.

2. Check for rouge software:
Record your usage, then leaving your PC on, but idle.    Check back much later on usage.
Any change would suggest you have software on your PC that you don't know about...

Ragnor

8279 posts

Uber Geek
+1 received by user: 585

Trusted

#186406 28-Dec-2008 19:58

Your ADSL account will only work on your physical line so it can't be someone else somewhere using your account. Either you or your kids are using more than you think or there is an error with their system. ISP's keep pretty meticulous records for obvious reasons. Chances are good it's something at your end you are not aware of.

Double check you don't have un passworded wireless enabled in your ADSL router.

I suggest you setup bandwidth monitoring on all your PC's, you'll probably find your kids have discovered youtube and possibly bit torrent in the holidays.

Also 9 GB in a month would be on average ~300mb per day, that is not very much if you have 4 PC's.

Ragnor

8279 posts

Uber Geek
+1 received by user: 585

Trusted

#186416 28-Dec-2008 20:38

Bandwidth Monitoring

http://www.simplehelp.net/2007/09/09/how-to-monitor-your-internet-bandwidth-usage-in-windows/
http://www.simplehelp.net/2007/09/27/how-to-monitor-your-internet-bandwidth-usage-in-os-x-redux/

Dell

Shop now for Dell laptops and other devices (affiliate link).

kfella2000

495 posts

Ultimate Geek
+1 received by user: 9

#186517 29-Dec-2008 15:22

Ragnor: Your ADSL account will only work on your physical line so it can't be someone else somewhere using your account.

I beg to differ here as my son borrowed my modem/router and used it for a while on his own account on his line. He gave it back to me after he bought a new modem/router. An issue arose on my line a few weeks later and so I tried this other router/modem to see if my new one was the issue. Anyway the one my son borrowed still had his settings in it and it connected no problems to his account on my physical line. Anyway I would also go along with what everyone else is saying if your modem/router is wireless capable disable or secure it as there could be cheeky neighbours or even drivebyers with laptops using your data or check and see if the kids are downloading files.

SATTV

1670 posts

Uber Geek
+1 received by user: 657

ID Verified

#186537 29-Dec-2008 16:20

The company my wife works for had a simalar problem and the Ihug help desk asked if they had recently installed Nortons Antivirus.
They had and the software was not set up properly and downloading updates / signatures every hour, they had four PC's and a server and they we all doing it, they changed it to get the updates from the server and that fixed their problem.

I hope you sort it out soon.

Cheers
John

I know enough to be dangerous

machealer

4 posts

Wannabe Geek

#186551 29-Dec-2008 18:00

I have installed the bandwidth monitoring tool

http://www.simplehelp.net/2007/09/09/how-to-monitor-your-internet-bandwidth-usage-in-windows/

I believe I can see the problem, insofar as the PC's even when "idle" appear to be downloading a lot more data than expected. Today alone my system has downloaded 230 megs and that was from a few visits to Stuff.

So I guess the next step will be to try understand what app is consuming it, perhaps the , spybot, Zonealarm or bitdefender antivirus programs. Even when Idle, it seems a constant inbound flow of 4-10k..

so thanks for the help thus far that has got me to this point, and much more informed to what's occurring !

Ive also engaged the zone alarm automatic internet lock on all systems after 10 mins idle, that may well help.

Niel

3267 posts

Uber Geek
+1 received by user: 80

Trusted

#186552 29-Dec-2008 18:10

Press ctrl-alt-del and look at the processes that are running. Scroll through them and look for something with a name in the line of torrent or P2P. You can then find out what the process is on Google. Just look for a description, there are some sites that would try to get you to download their scanning software which might in fact be spyware itself. There should be software around that does this for you. I use Spybot a lot, but it will not detect legit torrenting software.

You can never have enough Volvos!

exportgoldman

1202 posts

Uber Geek
+1 received by user: 3

Trusted

#186583 29-Dec-2008 21:12

machealer:
I believe I can see the problem, insofar as the PC's even when "idle" appear to be downloading a lot more data than expected. Today alone my system has downloaded 230 megs and that was from a few visits to Stuff

It sounds like your machine may be a zombie machine, and have hidden software installed on it which allows someone else to control it (and thousands of other machines) for their own purposes.

I would on each PC go to update.microsoft.com and keep going through the website untill all the patches are installed, and then make sure you have Antiirus installed and it's up to date.

If the traffic doesn't stop, then you can track where the data is going to/from on the internet, and what type of traffic it is by using ZoneAlarm, and scan your machine for spyware by using Windows Defender, Spybot Search & Distroy and also AdAware. Other people will reccomend their favourite tools as well, I find all these four with the latest Microsoft patches will rid a machine of spyware now days.

Tyler - Parnell Geek - iPhone 3G - Lenovo X301 - Kaseya - Great Western Steak House, these are some of my favourite things.

Mighty Ape

Shop now at Mighty Ape (affiliate link).

Ragnor

8279 posts

Uber Geek
+1 received by user: 585

Trusted

#186686 30-Dec-2008 15:22

kfella2000:
Ragnor: Your ADSL account will only work on your physical line so it can't be someone else somewhere using your account.

I beg to differ here as my son borrowed my modem/router and used it for a while on his own account on his line. He gave it back to me after he bought a new modem/router. An issue arose on my line a few weeks later and so I tried this other router/modem to see if my new one was the issue. Anyway the one my son borrowed still had his settings in it and it connected no problems to his account on my physical line. Anyway I would also go along with what everyone else is saying if your modem/router is wireless capable disable or secure it as there could be cheeky neighbours or even drivebyers with laptops using your data or check and see if the kids are downloading files.

I forgot to mention that xtra/telecom is an exception to the rule. You were using xtra right?

Ragnor

8279 posts

Uber Geek
+1 received by user: 585

Trusted

#186689 30-Dec-2008 15:26

If you suspect it's a virus and you don't think your current virus checker is detecting it you can try Trend Micro's FREE online virus scanner:

http://housecall.trendmicro.com/

kfella2000

495 posts

Ultimate Geek
+1 received by user: 9

#186690 30-Dec-2008 15:32

Ragnor:
kfella2000:
Ragnor: Your ADSL account will only work on your physical line so it can't be someone else somewhere using your account.

I beg to differ here as my son borrowed my modem/router and used it for a while on his own account on his line. He gave it back to me after he bought a new modem/router. An issue arose on my line a few weeks later and so I tried this other router/modem to see if my new one was the issue. Anyway the one my son borrowed still had his settings in it and it connected no problems to his account on my physical line. Anyway I would also go along with what everyone else is saying if your modem/router is wireless capable disable or secure it as there could be cheeky neighbours or even drivebyers with laptops using your data or check and see if the kids are downloading files.

I forgot to mention that xtra/telecom is an exception to the rule. You were using xtra right?

Both my son and I are on Xnet fusion

Niel

3267 posts

Uber Geek
+1 received by user: 80

Trusted

#186695 30-Dec-2008 16:31

kfella2000: Both my son and I are on Xnet fusion

I would expect you to be able to swap user name and passwords with any other customer of the same ISP, but you should not be able to do multiple simultaneous logins. As far as I understand when you sign up with one ISP your phone line is configured at the exchange to connect only to that one ISP. But the ISP can choose to allow more than one simultaneous logins or not at their end (most would not).

You can never have enough Volvos!

1 | 2