THinking laterally, I suppose there is the possibility that Virgin have completely screwed things up and just think this is happening. Given that they took over from NTL, nothing would surprise me.

But then surely there would be about 30 odd GB of downloads too and the OP said that the downloads were only about 4GB...

Depends where they do their monitoring, I doubt they expect to see download data coming to your port from your port and back, but you would see it as upload.

It's a right edge case mind.

Well after a few days since I set up mac filtering and changed my wireless key and admin passwords, I called Virgin and they say that yesterday and the last 3 days of uploaded data is 78mb. so lease its a much smaller amount - will continue to keep an eye on it.

Sounds like someone was connecting to your router via wifi and upload care of your connection.

Best hope you don't get a letter from ACS:Law anytime soon.

Even more reason to check the router logs and see if you can grab the offending MAC address. Hopefully whoever owns that machine won't have been smart enough to spoof it. If you do manage to do that, save the logs in an extremely safe place.

Best hope you don't get a letter from ACS:Law anytime soon.

Why what's this all about "ACS"

Lovely people. Team of lawyers who look for copyright infringements and then send threatening letters out claiming silly amounts of money with discounts for early payment. Frequently wrong, and not too mindful of the technicalities. If something copyrighted came through your router illegally, they'll treat you as if you're guilty and you'll have to fight to prove you're not. Even the government has raised questions about their methods, but nobody seems to be able to control them.

Well I dont know if we are getting somewhere when I ran Malwarebytes on my machine it found the following 7 issues...

RiskWare.tool.ck

Trojan.Agent.ck

Trojan.Downloader

Trojan.Downloader

Trojan.Agent,ck

Trojan.Downloader

Trojan.Downloader

All these were found with the same long number in the following...

D:\system volum info\_restore (3E8B-465C-E670-4481-A74B-D174FC98C68D)\RP337\A0089821.EXE

Are these above files dangerous? and in malwarebytes should i select the option to remove or quarantine. Thanks everyone.

I am amazed that my Kaspersky internet security did not find these.

Payable internet software isn't always the best option. Running a cross section of tools is always better, but most commercial products don't like it when you do. If Malwarebytes has found stuff, it's usually safe to kill it - it discriminates pretty well.

Some interesting bits and and bobs from that scan, all of them are nasties. BUT to get rid of the last one in _restore you are gong to need to disable system restore. Once its clear you can turn it on again though.

Some interesting bits and and bobs from that scan, all of them are nasties. BUT to get rid of the last one in _restore you are gong to need to disable system restore. Once its clear you can turn it on again though.

should i turn off system restore on both drives or just the D drive.

Just D: I think.

Where can you download malwarebytes from?

http://www.malwarebytes.org/

Where can you download malwarebytes from?

I got mine from cnet (www.cnet.co.uk)

Lovely people. Team of lawyers who look for copyright infringements and then send threatening letters out claiming silly amounts of money with discounts for early payment. Frequently wrong, and not too mindful of the technicalities. I

Even the government has raised questions about their methods, but nobody seems to be able to control them.

They would get sweet FA off me no matter how many letters they send,

Still worth saving your router logs and making a note of the times and dates just so you can close any issues down should they arise.

http://www.malwarebytes.org/

Thanks Manny.

Running a scan now myself.

Turn off wireless.

Connect a single PC to the router and disconnect everything else. Run a speed test after the machine has completely finished starting up. Note if your anti virus or windows update kicks in then clearly that will create a ton of traffic for a bit. Either way.

Once you have the results, disconnect that PC, connect next one, repeat etc.

If one of them shows a massively different speed compared to the others, that one is likely to have some upload type program active, most likely P2P related of course. There is tons of this junk out there, all it can take is a nasty toolbar coming along..

If you have any switches involved due to cable length & need to distribute traffic, it is worth having the test where you connect your switch and then only connect a single PC at a time to it, same process.

I don't know if any machines are running IPV6 and whether Virgin supports that now, but if nothing is using it you may as well disable that protocol IMHO - just in case - until such time as it becomes ISP supported.

Fingers crossed you'll find it, if not, at least you know your machines and network are sound.

A lot of routers also have DHCP client tables, you could compare that list against your machine's MAC addresses. Any that are clients but are not known to you, are suspicious.

Good luck!