The situation is that I'm losing satellite ISP data allowance and I assume it generates from hackers. I operate a small wired local area network with 5 workstations, a printer and a NAS. The satellite modem is connected directly to a SonicWALL firewall router. Connected to the router are two workstations, the NAS and a switch which leads to the remaining network nodes. The SonicWALL should stop the intrusions but apparently it doesn't. I have the Norton firewall running on the workstations.
There appear to be no viruses on any of the Windows workstations. I have run ESET, Norton, Norton NPE and nothing is uncovered. There appear to be no harmful processes running in Windows based on process explorer scans. I can run a Netstat on any workstation at any time and find ports with IP's with established connections that are untraceable. I assume those are the hackers. There is no point in blocking IP's because the IP's change all time. They are probably operated through VPN services.
I'm at wit's end. If there is anybody out there that understands what I'm talking about and has a suggestion on the next step I might take, please respond. Thanks.