Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When using Firefox to open a blank page, I have a weird network connection that shows under Network Activity in Resource Monitor (Windows 7).
The address is: insiders-guide.pacedev.com. A screenshot:
What the heck is this? I have never visited their site before today. Where is it coming from? How do I get rid of it?
I had this same issue about 2-3 weeks ago, with the same site coming up after running several scans with Roguekiller.
Prior to that the browsers would lock up or work very intermittently, (Firefox, Chrome, Edge, IE , Opera, ect.) Using a web browser in a game, running a VM or Tor worked, but even Tor would lock up after an hour.
This was on Win 10 64bit, with malwarebytes (full), Sophos home and malwarebytes anti-exploit running. No Java or flash installed, Ublock origins and Noscript installed for Firefox, built in flash turned off in Edge.
Uninstalling the browsers and resetting IE, then reinstalling other browsers would work for maybe a day before the issue re occurred. (Even removing IE and using other browsers on fresh installs, same issue!)
Malwarebytes blocked connection attempts to the pc 5+ times a day while this was going on, after roguekiller picked up the hooks and reg keys, no more issues ;)
Nothing was picked up on scans (MB, Sophos, or roguekiller) until the most recent update for roguekiller however! Drove me crazy, I ended up making live cd's to boot from to surf with. Browsers did work in safe mode btw.
I did assume that realty company had been breached or was just a fake when I saw the address as well.
It's difficult to tell just based on this. More information would be needed to make any solid conclusions.
If you really want to tell if it's compromised; reboot the system, use netstat to view any active connections. If a rootkit is installed, then you should see an unrecognized connection. The hard part is weeding this connection out amongst all the standard connections to Microsoft (these connections check for updates on boot, etc).
I did some poking around and can't find that domain name anywhere. After attempting pings, traceroutes, and using nslookup, I just can't find it. You may check your DNS cache to make sure that domain name isn't statically set to contact a server over the Internet.
While this activity is indeed suspicious, I don't think it's enough to mark the system as compromised. If you feel up to it, take the precautions listed above as well as run some anti-virus scans (Not a perfect solution, but if a rootkit is running without system level privs than it shouldn't be so hard to find it).
NOTE: If this activity is only related to your browser, your browser may have been hooked somewhere on the Internet. To fix this, just clear every setting your browser. Wipe everything, and the offending hook should be cleared as well.
