My internet connection status shows millions of packets when I'm not doing anything; do I have a virus?

Home » Networking » Windows Networking

Summary: A lot of network traffic can mean several things. It can mean that you're doing a lot on the internet or it could mean that some malware is.

•

Maybe, maybe not.

Okay, that wasn't very helpful. But to be frank I can't give you a definite yes or no. But we can do a little investigation to determine if what you're seeing is expected or a sign of a real problem.

•

I'll start with the obvious: you are running anti-virus software, right? And you do have the latest and greatest virus signatures for it, right?

If the answer to either of those was "no", then get thee to an anti-virus tool immediately, get it up to date, and do that scan. 99% of the time a good anti-virus tool will answer your "do I have a virus" question properly.

If anti-virus tools say you're clean then we start investigating. First, understand what the numbers in your connection status mean. Have a look at mine (from Start-> Settings-> Network Connections-> Local Area Network):

You'll note that I have 2 million packets sent, and almost 4 million received. That's count of the number of packets since that connection was made. You can see that the connection has been connected for almost three days. So the longer you stay connected the larger those numbers will get.

What's more interesting is how quickly they're changing as you do nothing. Chances are they'll grow even if you're doing nothing simply because you may be running some internet aware software - say an instant messaging program, mail program, or something else. But if they seem to be growing quickly there's activity that might be worth investigating.

In a previous article, How can I tell what internet activity is happening on my machine? I discussed several tools and techniques to see what's transpiring over your internet connection. I'll jump right to the tool mentioned at the end of that article, Sysinternals' TDIMon. Run it, log the output to a file, and then after running it for a minute or so turn it off and view the file in notepad. You should see lots of internet activity. Much of it you'll recognize as your own or perhaps as discussed in that article, expected standard windows tools. But if there's a program there that you don't recognize that seems to be doing a lot then it's probably time to understand just what it is. For that I've outlined several techniques in What's This DLL? that will work with .EXE files as well. That research should help you determine if you have a problem or not.

Article C1901 - March 7, 2004

Was this article helpful? «Yes» «No»