Windows 10 Unauthorised traffic

[Simon9595]

Genuinely a question with no idea where to begin, how to phrase question, how to resolve.

The basics, Win7 upgraded to Win 10, but problem began in Win7.

Current status... Win 10 on my son's PC, many many games, Steam Account, apps, typical teenager, albeit high spec hardware. Said machine is hardwired via X to a Sky Router BB account, typical black box from Sky which I believe is a Netgear unit. Said router has keyword blocking as it serves a typical household of different age groups. I decided to block certain profane pornographic key words of which it appears to do. However the gamer of the family (my sons machine) is constantly filling up router syslog with requests for porn keywords irrespective of machine being manned or not. Example... reboot machine, no one near or present to keyboard, syslog begins recording URL attempts to access porn. I have virus swept with a number of leading apps, cleared startup apps from MSCONFIG, ran Windows 10 Defender... nothing found. Said machine is making unauthorised calls every minute as per router syslog identifying one particular household PC via internal IP. Unfortunately the router does not report which URL it's calling, or from which installed program. I can of course bin the machine and reinstall from scratch but, (a) thats a huge job with so much history, steam account, huge gaming downloads etc... and (b) won't tell me what is doing what.

I'm not all that PC savvy, but can anyone advise where to start to figure out whats going on. Something is calling out without human at the helm, so what else might it be doing. If I can find the suspect I'll happily remove it, but thus far no way of finding the cause.

Any layman advice welcome.

ATB - Simon

 

[Neemobeer]

I'd start by powering off said computer and verify the traffic on router stops.
I'd grab a few different malware scanners such as malware bytes and spybot (download on a different computer)
Once you've confirmed the traffic is coming from the your son's computer, turn it on and boot into safe mode (keep pressing F8 while it boots) or When it boots hold shift and select restart and it should load the advanced start up menu and select safe mode with networking
Run the malware tools

 

[Simon9595]

Thanks Neemobeer. The traffic stops when the PC is switched off, powered down. I have noticed if put to sleep only it will wake up from time to time and continue it's unauthorised activities. I'll give your suggestions a try tomorrow and see what happens and report back. Thanks again.

 

[BIGBEARJEDI]

Hi,
Additionally, how many other computers do you have on your Home network connected to that same router? Reason I ask, is that if you have say 2 other computers (3 total); you have to make sure you clean off those other 2 computers at the same time you clean your son's; as they are probably infected as well. The virus on his computer will be sending copies to all other computers sharing the same router, and possibly the router itself. You mentioned Netgear is the router; and they are 1 of 3 brands pretty resistant to router viruses; but NOT IMMUNE!! I would proceed with the cleaning Neemo mentioned on ALL computers connected to your router first.

Then, disconnect ALL computers from the router for a 24 hr. period. Then connect back your computer ONLY directly to the router, and check to see if the outbound traffic has abated. If it is, connect each computer in turn to the router, and check it for outbound traffic. Finally, connect your son's computer (ONLY AFTER IT'S BEEN THOROUGLY CLEANED & DISINFECTED!!!) and check for outbound traffic on the router with your computer. If no apps are running on any of the computers connected to the router; then you've contained that virus infection and you should be good to go!

If you follow all our instructions, however, and outbound traffic is still being sent by 1 or more computers, you could have a router virus. They are quite rare; but I've run into them a few times over the last decade or so. If you suspect this is the case, you can try to fix it yourself, but it normally requires EXPERT networking skills to do so. It's also a several hundred dollar repair if you hire a Network Engineer or Network Tech to come out and fix the problem. Usually, replacing your infected router is required, along with possible reinstallation of ALL connected computers (all hard drives must be wiped clean!).

You'll probably not have to go this far; especially if you are able to resolve the problem. But, don't be deluded into thinking you can get rid of a nasty virus with software tools easily! In my experience, these types of viruses (worm or spyware type), usually require complete hard drive erasure and Windows reinstallation-whether it's a PIA or not; that's what it often takes. It's your network and your computers, so it's up to you. If you do think you have a router virus, and can't afford to pay a Network Pro to come out and clean up your mess, you can have a look at a recent Post I did on cleaning your own router virus here:
Drivers Constantly Being Corrupted

Best of luck to you;
Let us know how it goes; or if you have any questions along the way, we are here 24x7x365!

<<<<BIGBEARJEDI>>>>

 

[MikeHawthorne]

Hi

Be sure that your router is password protected, I logged into my neighbors router, which for some reason they have no password on, when I first got my tablet.

I think I used it for several weeks before I noticed that it wasn't my address that it was connected to.

When I turn on my pad, several other connections show up, but the others are secured.
I find this weird because I live out in the country and while I have some neighbors, it's not like I live in an apartment where this kind of problem is common.

Someone might be piggy backing on your connection to avoid the porn addresses showing up on their computer.

If you can change the password and see if they stop, I'd do that, just in case someone had figured out a way to get yours.

Mike