Prey using a lot of bandwidth on initial internet connect

[meeotch]

I posted this over at the community, but no replies, so I thought maybe this was the more appropriate forum:

I’m currently tethering my Windows 10 laptop (which has Prey installed) through my phone (which does not) in an area with little internet service, and so I have a data cap of about 500MB/day to worry about. I’ve noticed that every time I connect the laptop to the internet, the Prey executable seems to be up or downloading a large (50-100MB) amount of data.

How do I know it’s Prey? By using the Task Manager, sorted by network activity. I see the node.exe process running from the Prey install directory at the top of the list for several seconds following the connect, and I watch the data usage on my phone jump by 50-100MB. After the Prey process is done accessing the network, data usage slows to a trickle.

I've confirmed by stopping the Prey Cron Service, killing wpxsvc.exe and node.exe, and then connecting to the tether. Usage in that case was < 10MB. Unfortunately, I'm limited in the amount of testing I can do - because data cap.

This has happened several times over the past couple of days, so I don’t think it’s Prey downloading new versions. Is there something else that it does when a connection is first established that would be this heavy? And more to the point: is there a way of stopping it, without killing Prey altogether?

[SoraKenji]

Hey! I hope you're having a good day.

It could be that Prey is having troubles installing the newest version on your device and, because of that, it's actually downloading the same version each time your device has an active internet connection and the first time the application runs (after each time 8 hours has passed and your device has an active internet connection, Prey should try again).

Are you able to confirm that? You need to look at your prey.log located in C:\Windows\Prey\ (the installation folder). If you want, you can upload your prey.log and we can help you with that.

[meeotch]

Thanks for the reply. I suppose this could be the issue... Grepping for "update" my prey.log gives:

 notice Wed, 22 Mar 2023 22:05:41 GMT [updater] New version found winsvc: 2.0.13
 notice Wed, 22 Mar 2023 22:05:41 GMT [updater] Nothing to do. latest version already installed. 2.0.13
 info Wed, 22 Mar 2023 22:05:41 GMT [updater] winsvc updated
 info Thu, 23 Mar 2023 03:21:35 GMT [updater] Error to get stable version
 info Thu, 23 Mar 2023 17:19:50 GMT [updater] Error to get stable version
 info Thu, 23 Mar 2023 17:29:54 GMT [updater] Error to get stable version
 info Thu, 23 Mar 2023 17:29:54 GMT [updater] Error to get stable version
 info Thu, 23 Mar 2023 17:30:03 GMT [updater] Error to get stable version
 info Thu, 23 Mar 2023 17:34:44 GMT [updater] Error to get stable version

So it appears from the 22 Mar messages that I'm already up to date? I'm assuming "Error to get stable version" is just Prey failing to connect and determine the latest version.

Is there some way of temporarily disabling updates? I couldn't immediately find one in the web interface.

[JohaoRosasRosillo]

Hi @meeotch , thanks for your message, can you send us the .logs files ( prey.log, winsvc.log, prey.conf) so we can review them please?

[meeotch]

Sure. Can you let me know what info in there potentially needs to be sanitized before I post them here?

I found api_key and device_key in prey.conf, and HostID in winsvc.log, but it was hardly an exhaustive search.

[SoraKenji]

Sorry for replying so late.

Mmm there should be nothing too serious there. And yeah, the information inside of prey.conf is not necessary. So don't worry. In the rest of the files you would see things like the name of your machine and maybe your user (in the prey.log), if you want, you can delete those parts and then send us the file.

[meeotch]

ok - here ya go:

prey.log
updater.log
winsvc.log

[JohaoRosasRosillo]

Hi @meeotch we have released a new version (1.11.2), you can check it with this command in your terminal and send us the result.

C:\Windows\Prey\current\bin\prey --version
C:\Windows\Prey\wpxsvc.exe -winsvc=version

Thanks for your answer

[meeotch]

C:\WINDOWS\system32>C:\Windows\Prey\current\bin\prey --version
1.11.1

C:\WINDOWS\system32> C:\Windows\Prey\wpxsvc.exe -winsvc=version
2.0.13

[JohaoRosasRosillo]

Thanks @meeotch ,you can run this command as administrator taskkill /F /IM node.exe , this will restart the client and check for the latest update,
After about 10 minutes, run the command again to get the version, if it returns 1.11.2, everything will be ok, if it still shows 1.11.1, send us the logs (*.log) again please. thanks !!!

[meeotch]

Thanks - re-enabled the Cron Service, and it seems to have updated the prey executable to 1.11.2.

I'll leave it enabled for now, and keep an eye on the data usage to see if I'm still seeing the jumps I saw before.