# DSL Router being overwhelmed

**URL:** <https://boards.straightdope.com/t/dsl-router-being-overwhelmed/486929>\
**Category:** Factual Questions\
**Created:** [February 22, 2009, 7:44am UTC](https://boards.straightdope.com/t/dsl-router-being-overwhelmed/486929 "2009-02-22T07:44:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rico](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rico/32/3582_2.png) [@Rico](https://boards.straightdope.com/u/Rico)\
**Post date:** [February 22, 2009, 7:44am UTC](https://boards.straightdope.com/t/dsl-router-being-overwhelmed/486929/1 "2009-02-22T07:44:14Z")

</div>

An old friend just moved into the downstairs apartment and I told him he could hook up to my wireless DSL.

Tonight his computer started doing something very strange. The web activity log of the router showed his computer connecting to Microsoft, Google, Yahoo, and Intel websites. Over and over again. 20-30 hits per second. He’s disconnected now, otherwise all web activity was blocked off from our other computers.

I went downstairs and ran malwarebytes and Super Anti Spyware. Nothing. AVG showed no problems either. We restarted the wireless card and the hits started again. He’s disconnected now.

He’s running Windows XP Corporate and a Netgear wireless card.

Any ideas? I’m at a loss.

---

<div class="post-metadata">

**Author:** ![brujaja](https://avatars.discourse-cdn.com/v4/letter/b/4af34b/32.png) [@brujaja](https://boards.straightdope.com/u/brujaja)\
**Post date:** [February 22, 2009, 8:00am UTC](https://boards.straightdope.com/t/dsl-router-being-overwhelmed/486929/2 "2009-02-22T08:00:19Z")

</div>

Sounds like botnet to me. Check the exceptions in the firewall, look at processes in task manager, stuff like that. Root Kit Revealer is good for diagnosing too. Errr… your wireless network is secured with a password, right?

---

<div class="post-metadata">

**Author:** ![Rico](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rico/32/3582_2.png) [@Rico](https://boards.straightdope.com/u/Rico)\
**Post date:** [February 22, 2009, 8:05am UTC](https://boards.straightdope.com/t/dsl-router-being-overwhelmed/486929/3 "2009-02-22T08:05:50Z")

</div>

> [@brujaja](#):
>
> Errr… your wireless network is secured with a password, right?

Yes - I neglected to mention that. Router is secured. I only see the computers I’m supposed to see on the DHCP user list screen.

---

<div class="post-metadata">

**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\
**Post date:** [February 22, 2009, 2:05pm UTC](https://boards.straightdope.com/t/dsl-router-being-overwhelmed/486929/4 "2009-02-22T14:05:32Z")

</div>

He’s a bot. Kill him.

---

<div class="post-metadata">

**Author:** ![Kevbo](https://avatars.discourse-cdn.com/v4/letter/k/e47774/32.png) [@Kevbo](https://boards.straightdope.com/u/Kevbo)\
**Post date:** [February 22, 2009, 8:30pm UTC](https://boards.straightdope.com/t/dsl-router-being-overwhelmed/486929/5 "2009-02-22T20:30:06Z")

</div>

As others have said, this is botnet behavior. Somewhere is a h4x0r using your roomy’s computer to eat bandwidth of the servers it is communicating with.

Download (free) and install MalwareBytes. Boot in safe mode,\* have it get the latest updates. and see what it finds.

\*The last malware I found blocked MalwareBytes updates hence the need for safe mode, which is always a good idea when you suspect an infection.