Online Armor constantly downloading (using bandwidth)

My PC (XP SP2) has been constantly downloading or using download bandwidth at a rate of about 1.3 kB/s on average (it runs in blocks of 1.6 kB/s with short gaps of nothing in between). This is when it is not supposed to be doing anything. At this rate, leaving the computer on for 10 hours uses about 50 MB, which is 1.5 GB a month!

The problem seems to be the Online Armor (Free version) firewall. When I turned it off, the downloads stopped.

I now have the Windows firewall running instead - I notice that my computer is still downloading in blocks, as before, but at a rate of about 0.04 kB/s instead of 1.6 kB/s.

Is that normal behaviour for OA? If so, I believe I'll give it the flick.

(I have already been through the Malware Removal process on my computer for a different problem so I guess it's not a malware problem.)

We have 3 computers on our home network - could OA be checking traffic through the modem from the ther computers?

I checked the OA FAQs, but nothing there.

 

Not sure about OA but it may depend on the set up options. Personally I remove any "send information" options etc during my set up and running off any app.

 

Thanks. It's actually download, though, not upload. I haven't been able to find any options that would cause downloading.

 

Thanks Plodr and Digitalocksmith.

I have Windows updates and AV set to alert me when downloads are available. I have shut down all non-essential applications and processes and it keeps on going... drip... drip... drip...

I have also opened a Firewall Status page on OA to see what's happening there. It shows the same sort of behaviour there - blocks of download, but only going up to about 80 B/s - gradually rising over about 4 seconds, staying up for about 12 seconds, then gradually falling again.

I have found that my son's PC (Vista) is doing the same thing. He doesn't have OA, so I guess that rules that out (except that it pretty much stops when I turn off the OA firewall).

It is starting to look like LAN activity, but I disconnected two of our three computers, and it kept on going - I don't know enough to know if that should do anything. Could this be something to do with the modem? - BIGPOND 2Wire 2701HGV-W, ADSL. Two computers (my XP SP2 and a laptop with Vista) connected wirelessly and one (Vista PC - the other on that's doing it) on Ethernet.

The Networking tab on Task Manager shows the Wireless Network Connection doing the same thing also.

Other items of interest:

I use Open DNS on the XP.

I have used both XP and Vista PCs (but not the laptop) for Remote Access to my work computer.

Thanks again for your help.

I'm not sure if I've done what you suggested Digitalocksmith. If you can make sense of the above, you might be able to tell me. I don't now think it's an Online Armor issue except that OA firewall is picking up something else. Not sure what to check for with remote addresses and IPs - but maybe I've answered that question above?.

 

I posted my problem on an OA forum - there's someone there who says he's seen this before and that I should do a fresh install of OA. I don't know how that could affect the PC that doesn't have OA, but I'll give it a try and post the result.

 

Thanks Digitalocksmith.
I have emailed our tech guy at work to see if he can answer your questions - I can't, except to say that as far as I can remember, I just followed the normal Windows instructions for setting up remote desktop connections. I don't think there is anything in particular like a VPN (I had a bit of a read to see what that was). I think OA configured itself when I did that - I don't recall having to open any ports or anything.
Are you aware that my problem occurs even when I'm not connected remotely? Does that make a difference?
Just to recap - the problem occurs even when the computers are just idling - no connections (except to the router) and no applications running.
Thanks again for your interest and help.

 

Thanks Dls.

I read that it was advisable to have an outgoing firewall, and that my modem/router only provided incoming checks. Do you disagree? I'd be happy to do without it if I could.

I have attached a screenshot of Task Manager and Netmeter. I have also attached screenshots of Netmeter graphs for with and without OA, and for Ethernet and Wireless connections, as well as both together.

Yes, as you can see.

 

Thankyou very much Dls.
I'll have a look at 'Nslookup' or 'tracert' commands (not sure what they are yet), although my problem is incoming, rather than outgoing.

Yes - I uninstalled OA, as you suggested, before looking at Task Manager.

I'm sure now that it's not OA doing it - OA just seems to amplify the downloads for some reason!

 

Thanks again.
I tried to find the router logs but no luck. I'll have to put it on hold as it's now 2 am and I have to do paid work tomorrow (and be awake).
Had a quick look at Nslookup as well. Looks like I've got more learning to do on this.

 

Thanks for the reply and for the offer to look at HJT logs. Greatly appreciated. I have attached the log from my computer (the offending one) for a start.

 

I mistakenly put a check next to these entries and 'fixed' them. I thought you were referring to the entries above when you said to do that, but I see now you meant the ones below. :-o
Isn't it a good idea to keep software updated?

I uninstalled it a week or so ago to see what would happen and it didn't make any difference to the problem. So I put it back again. Then you said it wasn't needed, but I haven't yet taken it off again.

I have uninstalled MSN - still getting the mystery downloads.

I'll post an HJT log from the other PC on the network shortly (running Vista).

It might be of interest to know that when I boot the computer, the blocks of downloads don't necessarily start at the beginning of a block. It can start anywhere in a block. For example, the first block might be halfway through when the netmeter starts, then there's a normal gap, then normal sized blocks of download after that. This also makes me suspect that it's independent of this PC.

Thanks for your help.

 

Here's an HJT log from the Vista PC. This one is doing the same thing - at the moment at least.
I can't do the other computers (laptops) at the moment. I don't have access.