Nub

Have a problem in that for the last 2 days my Windows 2000 system has been uploading, what i dont know, and will not stop unless i block it.

Image from the last 2 days on my draytec router has been:
IP: 192.168.0.2 | TXRATE: 308 | RXRATE: 8 | Sessions: 12 | Action: Block

And yes i have been using the block option ALOT. I can understand updates and what not but to be constantly uploading 300kbps for days has got me going crazy. You block it, (block lasts 5 minutes) when it unblocks it starts up again as if nothing happened.

I cannot find any viruses at all, using NOD32 with the latest updates.

NAT Table shows the following IP's/Port's connected:
192.168.0.2 1286 50608 92.52.79.44 5721 WAN1 <-- uk
192.168.0.2 25 25 93.124.6.29 41716 WAN1 <-- russia
192.168.0.2 10260 59582 62.239.224.236 25 WAN1 <-- uk
192.168.0.2 25 25 84.229.233.220 28638 WAN1 <-- israel
192.168.0.2 25 25 60.248.118.109 23414 WAN1 <-- taiwan
192.168.0.2 25 25 222.254.248.138 63599 WAN1 <-- vietnam
192.168.0.2 25 25 123.27.118.163 24456 WAN1 <-- vietnam
192.168.0.2 25 25 81.7.89.189 51248 WAN1 <-- lithuania
192.168.0.2 25 25 123.23.69.5 14336 WAN1 <-- vietnam
192.168.0.2 25 25 125.166.22.161 9770 WAN1 <-- indonesia
192.168.0.2 25 25 117.0.147.111 21680 WAN1 <-- vietnam

I have Port 25 for mail. The location of these IP's are quite worrying, why are 3rd world countries they trying to connect to my mail server? There is no reason for it right?

Well my question is how do i stop this stuff? Can i block a whole country or even continent from connecting to me somehow?

blah789

I'd do some malware scanning (antivirus and anti-spyware). You could have a rogue spambot trying to make outbound connections to mail servers and sending spam e-mail.

Haresh

it should be a trojan! who upload and download itself without knowledge of user.