Unable to identify net usage

Hi,

Currently I have 3 computers in a remote location that access the WAN via a Cisco router.
Trend Micro is used as anti virus suite with malwarebytes used whenever there is a possibility of infection.

There has been an unusual amount of activity from these three computers over the last week. Going from no more than about 150Mb a day up to nearly 3Gb per day in the last week. The average download usage seems to be about 1.5Gb to 2Gb a day at present.

I am ensuring the computers are turned off at night, this has stopped all usage during the evening. I am checking the standard ports including standard peer to peer ports on the router, with nothing unusual logged yet.
I have run through many malware scans, I had removed some malware early on but in the scans I have done following your tutorials nothing has come up.

I dont think the issues here extend to unspecified access points being brought into the LAN. At this point I about the only thing I am sure of is that it seems to be affecting all 3 computers and it is definitely only on the computers (as it stops when they are off and immediately begins when they are on).

Logs from your walk through are attached. I would really appreciate any help to figure out what is going on here.

Thank you!

 

and the last one

 

Thank you Chaslang.
I believe I have the problem sorted, Ill detail it just in case this helps anyone else in a similar circumstance.

Before I do that...Dameware is a remote desktop application that allows me to log into a remote machine and control it, without booting off the user at the other end.

Ok, so the computers at the remote site use Trend Micro Worry Free Security. This product uses a server to control the application and the clients (on the remote machines) talk to the server to download updates, etc.

In this case 2 of the clients had somehow become glitched and were constantly trying to update thier virus definitions. This would happen at half hourly intervals.
Completely removing the clients from the machines and then reinstalling them with the latest client seems to have corrected the problem.

I had setup an access list on the router that I was monitoring, but this didnt really help much. I was at the point of installing Wireshark when I noticed the constant regular activity from my ISPs logs and put 2 and 2 together.

Thank you very much for your excellent tutorial on Malware removal, I will certainly be using that again in the future.