New subscriber Nelson H. wrote to ask a question about his Internet access:
I have adsl2 on my computer and I belive someone is stealing my usage by accesing my connection.
I cannot find what program is running on my comp, but my usage is going through the roof even although I am not running any internet programs.
How can I check this problem?????
I’m going to take a stab at this problem, but Nelson made several mistakes or omissions when he emailed me his question.
First, Nelson used an email address that was not the address he used to subscribe to my newsletter. I check that before I respond to requests — non-subscribers do not often get answers to their questions… Tonight, I searched for his name and found that he subscribed with gmail account but emailed me from his ISP account.
Second, Nelson told me he had ADSL2, but did not tell me if the ADSL2 modem was connected directly to his computer, or whether it connected to a router and the router connected to his computer. Not only that, but a wireless router is a different problem than a wired router.
Third, he did not tell me how he knew his usage was going through the roof even when he was not running any Internet program.
Fouth, he didn’t mention which version of Windows he is using.
Therefore, I’m going to make some assumptions. I assume that he sees the data activity light blinking on his ADSL2 modem and that’s how he knows that there’s a lot of activity. I’m also going to assume that his ADSL2 modem is strictly a modem, and not one of the combined modem+router models.
This light usually means that there is data flowing between the modem and the router or the modem and the computer, if there is no router. It does not mean that the data is meaningful — it just means that there is data flowing.
The blinking light could indicate attempts to get into his computer from the Internet. His router (if he has one) would stop this — but the data activity would still be there on the Internet side of the router. If he doesn’t have a router, hopefully he has a good firewall (not the Windows XP or Windows Vista firewalls).
Windows, and some of the programs that we install, have a number of programs that are installed as Windows Services and run all the time. They don’t show in the list of Applications in TaskMaster (control-alt-delete, Start Task Master) but they show in the lists of Processes and Services. Some of these are Internet capable and access the Internet.
You can use the program netstat to show you that something running on your computer is talking to the Internet. Start > Run > cmd (press enter). Then, in the command window, type the command "netstat" (without the quotation marks). You’ll get a response showing some of the Local Address and the Foreign Address of the current TCP and UDP connections from your computer. If you want to see them all, type "netstat-a " or "netstat -n".
If you have a good two-way firewall, which you do if you run most commercial firewall programs, you should be able to use it to stop any Internet access from your computer. That will tell you if it’s something running on your computer.
If you have a wireless router and someone is getting in that way, you need to lock down your wireless network.
Basically, you need to:
- set a password on your router (not the default administrator password),
- change your wireless to be encrypted (preferably with WPA or WPA2 – WPA2 is better),
- set a good password (not a dictionary word, use upper and lower-case letters and also numbers
- change your SSID to make sure that your SSID is unique (so you know you log into your router and your neighbor knows it’s not his router),
- turn off the SSID broadcast (a minor help), and
- set the MAC address filters to accept wireless connections only from the MAC addresses of your computers.