Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My wife's computer was recently compromised and I have tried to clean it.

I installed Microsoft Network Monitor to see if there was any unexplained internet traffic and I noticed a connection to Dropbox. Here is the given details:

URI: /subscribe?host_int=34404476&ns_map=162130732_8752065324,26351085_36339744642541,129513375_382381602719&user_id=16845707&nid=0&ts=1386575431

Host:  notify8.dropbox.com

Process Name Dropbox.exe

Note, neither myself nor my wife use Dropbox. I checked the install date for the instance of Dropbox that is on her machine and it has an install date of May this year, so this was probably not installed as part of what ever virus etc. infected the machine.

I tried to do a reverse lookup on the IP 108.160.162.115 and I got nothing.

Does this look like my wife's machine is trying to connect to a particular Dropbox account to retrieve some software (possibly malicious)?

share|improve this question
    
Apologies, I couldn't find suitable tags. –  xiaohouzi79 Dec 9 '13 at 8:07
    
The IP: 108.160.162.115 is within Dropbox. –  daniel Azuelos Dec 9 '13 at 9:03
    
Please clarify your diagnosis: "so this was probably not installed as part of whatever virus...". –  daniel Azuelos Dec 9 '13 at 9:04
    
Please add how you diagnosed your system compromise? –  daniel Azuelos Dec 9 '13 at 9:05
    
@danielAzuelos - Long story, but I installed a piece of software and then my browser settings were all screwed and I then ran Security Essentials which detected a trojan. –  xiaohouzi79 Dec 9 '13 at 10:08

2 Answers 2

If your system has been taken over an attacker could manipulate the install dates of any software, so anything you see on a hacked system must be treated with doubt. The IP address you listed is a valid dropbox IP, however that means nothing - if I was writing malware I'd seriously consider using dropbox to distribute it. It's robust, completely free, and people are likely to discount it as a threat vector: "Oh that's just dropbox, don't worry about it."

So it is entirely possible that the malware installed uses a dropbox labelled process to actually connect to dropbox and download latest versions of malware and operating instructions, although that scenario is not particularly likely. It is much more likely that this is actually a completely legitimate dropbox installation that you don't remember installing, and therefore a red herring. Unfortunately, there's no way to know for sure as once a system is hacked you can never trust it again. Your best bet is to wipe your system and start over.

share|improve this answer

To answer your question, it does seem that your wife's laptop is trying to connect to that IP. Reboot the machine, and without opening a browser, run netstat -ano from the command prompt.

If you see the IP there - or any dodgy connection for that matter from this command's output, take note of the PID (Process Identifier) associated with this connection from the fifth column. Then, open Task Manager (using Ctrl+Shift+Esc), and, go to View -> Select Columns....

A new Select Columns dialog box will pop up; tick/check the second item PID (Process Identifier). If you find the same PID that you took from the netstat -ano's command, this PID will most likely be related to a process, which might serve as a clue as to which file is initiating the connection.

You can then reboot the computer in Safe Mode and remove the file, if you are confident this will not break your OS.

Also, you can check a few standard locations. Please check this question I once asked: it might provide some insight.

Re-run some anti-virus scan.

You can also block this IP from coming in or going out your perimeter firewall.


Having said all that, this is all fine if you are just wanting to play about and see the places where the malware can interact with. Still the recommended course of action is a full Nuke of your OS. I would definitely not leave my wife's laptop with some dodgy leftovers.

share|improve this answer
    
I've seen the full nuke as the suggested option on this site. I will definitely be doing that before weeks end. Thanks. –  xiaohouzi79 Dec 10 '13 at 10:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.