I have this download occuring at precisely 3:23am every morning. I am permanently connected to my ISP thru an adsl connection. I don't know what it is. I have ZoneAlarm Pro working but that does not stop it - if it a hacker. Please can someone show me which process i should be checking to see what it may be. There is NOTHING in Task schedular that is set up and Windows automatic downloads is disabled. The only way to combat this mystery download (which varies in size but is usually about 25mB) is to pull the telephone line plug every night. That stops it. And it's using up my monthly allocation of paid-for data access. Thanks

How do you know your system is doing this? Is there a file created? Is your anti-virus perhaps set to update? It would help if you could provide a little more information. One thing I find curious. You have a limit as to how much data you can download per month? Hmmmm I've never heard of that before...

hi gaz, lets try this to see if you are hacked. hit your start button, go to the run button and hit it, then type in command, in the ms dos prompt box where you see the flashing cursor type in netstat -an (as you see it)you will now see the box with 4 columns: proto, local address, foreign address, state. if you see anything in foreign address with an address followed by a port number take note of it. if it is followed in the state column with the word established, then you will know you have a new friend. with the address and the port number taken, go to www.thepublicworks.com, security section, link to tantalo ports, put in the port number and do a search, if the results tell you that you have a trojan, note it down, then while at the publicworks, link to simovits consulting and do a search on the trojan by name and read up on the info on the trojan. then still at the publicworks, go to payware section, link to trojan hunter anti-trojan, download free 30 day trial, get latest defs, and scan your machine in safe mode, delete all files it comes up with. all the best, murve

Murve, saw your post above, and ran your CMD since I'd never heard of it. Found 4 established foreign addresses at ports 1025 thru 1028. I've run 3 trojan detection programs with negative results, and Shields Up shows my computer as completely stealthed. It should have been this way prior to me ever hooking to the internet. After checking the port numbers on Google, I would guess these findings in WWW.publicworks.com are either benign or false positives, is that correct? Thanks.

around 3am? could it be windows update?

hi johnO. netstat is a port monitor and it gives a true picture on what ports are opened on all computers. if it found that these ports are opened on your machine and if you checked with Tantalo Ports and found that ports 1024 1025 udp NetSpy trojan, 1025 udp Maverick's Matrix trojan, and 1027 tcp ICQ trojan, then you may have those trojans in your computer hiding somewhere. the anti trojan software may not be picking up those signatures. you may want to try the trojan and port test at pcflank to get another picture of what may or may not be on your computer, i think you can access it by going to www.thepublicworks.com, security section, in security tests area. all the best, murve

Murve, thanks for reminding me of PC Flank. Well, I ran all of its tests, and it didn't find anything either. If I can't find it I can't clean it. My Zone Alarm Pro was installeed and set up, along with my IE security and AV before this thing was ever connected. I have d/l a few programs, but they're programs I've used for years. Well, can't worry about it, nothing is getting out that shouldn't.