2

Would anyone be able to have a look at the pcap from my computer? I am thinking my computer get attacked by a process and keeps sending out packets from my computer to DoS my network.

I get errors in DNS very often and I simply cannot use the internet. pcap

closed as unclear what you're asking by Neil Smithline, schroeder Apr 11 '16 at 4:19

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • which IP in the pcap is yours? – schroeder Apr 11 '16 at 4:14
  • 1
    Have you looked at the pcap to see what might be going wrong? There's a lot of DNS traffic. The pcap also doesn't help to narrow in on which process is causing the problem. – schroeder Apr 11 '16 at 4:18
2

a pcap would be useful PROVIDED whatever process is responsible for generating the packets isn't also protected by any sort of application that is intercepting system calls. I.e. most good viruses typically use a loader that prevents the OS from reporting packets or processes generated by specific processes.

1

Analyze the packets, to find the source port number. Use this port number in a tool like cports, to obtain process id. You can track the process name and its respective executable from the pid in task manager. Check if that process is one, which you have initiated, or is it doing any thing useful to your work. If not then kill that process. Moreover, if that process is activated everytime, when you starts your machine, then may be it'll be a startup program/service or a scheduled task, which you have to disable and remove.

Not the answer you're looking for? Browse other questions tagged or ask your own question.