Back in October I went to a business who received a warning from their ISP that they were utilizing large amounts of bandwidth to the tune of about 300GB/mo for a small 3 PC office. I poked around asking about the wifi and whether the adjacent apartments were sharing his connection. I then proceeded to focus my attention on one PC in the office that was showing more network traffic than the rest. I installed a net monitor app and quickly found the culprit was a file named agent.exe. Found the containing folder was
C:\ProgramData\Macrovision\FLEXnet Connect\6
It Looked suspicious at first but Google searching revealed it's an updater app used by various software vendors. Not knowing which software on the machine was using it, I decided to kill it and move the offending exe to the parent path.
The app is not listed in Programs.
Fast forward to today and the client calls again with the warning from their ISP they are consuming large amounts of bandwidth again. I logged in remotely and checked the net monitor and found it was the same app. I looked at the modify date on the folder and then checked for programs installed the same day. It turns out it was installed by an update for his Autobody software called CCC One. I told him to call them and ask about the updater software. I'm still wondering what in the world agent.exe is doing. My thought is it's trying to download an update of some sort and not finishing for whatever reason so it restarts and is basically in a loop. The hard drive is not filling up either so my guess is that it's constantly overwriting what it downloads.
Anyone run into anything like this before?
C:\ProgramData\Macrovision\FLEXnet Connect\6
It Looked suspicious at first but Google searching revealed it's an updater app used by various software vendors. Not knowing which software on the machine was using it, I decided to kill it and move the offending exe to the parent path.
The app is not listed in Programs.
Fast forward to today and the client calls again with the warning from their ISP they are consuming large amounts of bandwidth again. I logged in remotely and checked the net monitor and found it was the same app. I looked at the modify date on the folder and then checked for programs installed the same day. It turns out it was installed by an update for his Autobody software called CCC One. I told him to call them and ask about the updater software. I'm still wondering what in the world agent.exe is doing. My thought is it's trying to download an update of some sort and not finishing for whatever reason so it restarts and is basically in a loop. The hard drive is not filling up either so my guess is that it's constantly overwriting what it downloads.
Anyone run into anything like this before?
