Windows 10: How to temporarily stop as much as possible Microsoft network traffic on a potentially...

I'm working on a potentially compromised Win10 machine on whIch suspected malware may be trying to exfilitrate data. ProcMon logs seem to suggest attempts to use one or more of multiple channels BITS or straight FTP jobs, referencing a Wininet.DLL instance out of Temp, SysApps or user AppData, odd scheduled Tasks, finding Services whose paths do not show in the Services applet, etc.The machine is - and has long been - isolated from the network. But I need to connect it briefly to determine any attempted target endpoint addresses / URLs while blocking the actual connections at the edge fi

:)

 

Temporarily stop Windows Update

I see. It is interesting that an automatic update slows your computer down as it usually runs in the background and doesn't take up a huge amount of memory.

You could look at increasing the speed of your computer by:

• Uninstalling programs that you no longer need
• Install CCleaner to do a quick clean up of non-important files
• Type 'msconfig' into search and in startup > taskmanager select the programs you actually want to be running at the start of a boot (leave all microsoft and system services checked)

Did you find any success in my suggestions from my previous post?

I did find an article on this which focuses more on a temporary stop for windows updates which I hope will give you a solution *Wink

As annoying as windows updates can be, I do encourage you to leave automatic updates on where possible as it does make you computer more secure and improves general performance

 

Did our Epson printer get hacked?

Another question, is this on a home network or a work network? The steps @eidairaman1 listed are always a good first step. If this is on a work network you manage, I'd be much more concerned than the home one. It is possible someone is screwing with you, but malware could also be the culprit.

 

Very slow internet traffic

I guess the next step would be temporarily bypassing the firewall and checking it's configuration?