I look after a small company with 10 workstations on Windows 7 and one server running 2012 Essentials.
The company contacted me to say that the internet was slow and it was affecting emails. They had been in touch with the internet supplier who told them that it was due to upload saturation and something was uploading 4 gig an hour since last Thursday night.
After getting them to switch everything off overnight - except the modem/router - the uploading stopped. It seems only when the server is re-introduced does the problem re-appear.
The server isn't using any cloud backup and all emails are dealt with by Exchange Online. It is essentially a DC and file server.
I am suspecting bitcoin mining or botnet but I would be grateful for any ideas and/or potential solutions.
I am going to see the company later today so will see if I can find anything out but any suggestions in the meantime would be warmly welcomed.