Network Traffic Cont.

I killed the connection to the WDCloud NAS and that immediately stopped
the majority of random high data rate high volume data.
Since I was only making the WDCloud a drive letter I just killed that
driveletter. I think the NAS is still available in the Network area on
this PC.
What was it doing?


Paul suggested an easier app: TCPView

I see System with high data and did a WhoIs

In WHoIs I get
www.cscprotectsbrands.com
AT&T

Are they putting out bursts of high volume data from my PC to where?

I still get bursts of outgoing that data occurring randomly.

Still nothing bad on the scans by Malwarebytes and several other apps.

--- news://freenews.netfront.net/ - complaints: ---

I killed the connection to the WDCloud NAS and that immediately stopped the
majority of random high data rate high volume data.
Since I was only making the WDCloud a drive letter I just killed that
driveletter. I think the NAS is still available in the Network area on this
PC.
What was it doing?


Paul suggested an easier app: TCPView

I see System with high data and did a WhoIs

In WHoIs I get
www.cscprotectsbrands.com
AT&T

Are they putting out bursts of high volume data from my PC to where?

I still get bursts of outgoing that data occurring randomly.

Still nothing bad on the scans by Malwarebytes and several other apps.

--- news://freenews.netfront.net/ - complaints: ---

I cannot kill that process found in WhoIS.
I can disconnect but about one minute later it automatically starts
again.
When disconnected the random bursts stop until the thing restarts
itself.

It is disrupting my LAN!

Does anybody know what startup or service it is connected to. I looked
and do not see anything that looks like the culprit.

Maybe I should dump AT&T and go to cable. Suggestions on that?

--- news://freenews.netfront.net/ - complaints: ---

OldGuy wrote:
I killed the connection to the WDCloud NAS and that immediately stopped the majority of
random high data rate high volume data.
Since I was only making the WDCloud a drive letter I just killed that driveletter. I
think the NAS is still available in the Network area on this PC.
What was it doing?


Paul suggested an easier app: TCPView

I see System with high data and did a WhoIs

In WHoIs I get
www.cscprotectsbrands.com
AT&T

Are they putting out bursts of high volume data from my PC to where?

I still get bursts of outgoing that data occurring randomly.

Still nothing bad on the scans by Malwarebytes and several other apps.

Possible pupware, malware,the comp has been hacked, or csc has been hacked.
Lots of things you can do to track it down.

If it were my system I would:
1. Install a decent software firewall and use it to track which programs
are asking for access. IMO, Zonealarm 9.2.102.000 for W7 was the best one.
The new ones are bloated garbage with less user functions.
(I periodically try many firewalls including pay ones.)
2. Task manager-Resource monitor, click on all the tabs.
3. Install and use the following:
TCPview
Cports
Autoruns
There are more.

On Sat, 14 Nov 2015 09:21:56 -0800, OldGuy wrote:

I killed the connection to the WDCloud NAS and that immediately stopped the
majority of random high data rate high volume data.
Since I was only making the WDCloud a drive letter I just killed that
driveletter. I think the NAS is still available in the Network area on this
PC.
What was it doing?

Judging by what you wrote, you were syncing one or more folders to your
WDCloud account. I suppose the easiest thing to do would be nothing at all.
Just let it run to completion. Once it's sync'ed, it should go quiet.

Note that a drive letter, by itself, doesn't enable or disable network
traffic to a remote host. Drive letters are only a convenience, not a
requirement.

Paul suggested an easier app: TCPView

I see System with high data and did a WhoIs

In WHoIs I get
www.cscprotectsbrands.com
AT&T

My guess is that you didn't use TCPView properly.

Are they putting out bursts of high volume data from my PC to where?

I still get bursts of outgoing that data occurring randomly.

Still nothing bad on the scans by Malwarebytes and several other apps.

--- news://freenews.netfront.net/ - complaints: ---

Yes, you use freenews. We get it.

I cannot kill that process found in WhoIS.

If it was truly System, then you shouldn't be surprised that you can't kill
it.

I can disconnect but about one minute later it automatically starts
again.
When disconnected the random bursts stop until the thing restarts
itself.

It is disrupting my LAN!

Does anybody know what startup or service it is connected to. I looked
and do not see anything that looks like the culprit.

Maybe I should dump AT&T and go to cable. Suggestions on that?

Where did that come from? You said above that it's related to your WDCloud
NAS. If you dump AT&T will you dump your NAS along with it?

--- news://freenews.netfront.net/ - complaints: ---

Yeah, we get it. You still use freenews.

Anyway, I asked some questions and made some general suggestions in an
earlier post. I haven't seen a follow-up so I guess I missed the mark. The
ball's in your court.

--

Char Jackson