@Nihil

...thanks for feedback. I would check the source but the source IP keeps changing. I have a feeling that its malware running. The client uses bit torrent. He says he has stopped his downloads but I think it might still be running in the background.

any other ideas?