Blocking DiagTrack outbound connection after malware infection

Question

I was scammed and I thought those scammers were really from Microsoft so I let them remotely connected to my computer. I don’t know what they installed on it.

After I realized that it was a scam, I reset my computer, cleaned all the drives and reinstalled Windows 10. I thought whatever virus I had should have gone away.

But I typed in “netstat -ano” in command prompt, and I still see this:

TCP    192.168.1.9:49793      111.221.29.254:443     ESTABLISHED     6752

I looked up the PID in Task Manager, it is DiagTrack service which is like a key logger right? And the IP that’s connected to it: 111.221.29.254 has been reported 8 times in AbuseIpDb.com.

I don’t know why after I totally reset my computer, this IP is still connected to me.

I thought about blocking this IP by modifying host file.

I used nslookup 111.221.29.254 but couldn’t find the hostname for this ip.

Server:  NF4V.Home
Address:  192.168.1.1

*** NF4V.Home can't find 111.221.29.254: Non-existent domain

Is there anyway I can block this IP from connecting to my computer?

Is there anyway I can block this IP from my router?

Answer 1

If this is a basic, fresh Windows 10 install, this is probably NOT persistent malware. This is most likely Windows Telemetry services - since Windows 8, Microsoft has been adding more and more automated "phone home" functions into their OSes - some of which are exceptionally difficult to disable. This is all related to the "Application Experience" functions of the OS (benign reasons to do this - to get performance data about the OS and applications, to determine how people use their OS. Malevolent reason to do this - data gathering, ad serving, etc)

References to this server online point to Microsoft Singapore, and there are a lot of people reporting DiagTrack as a Microsoft telemetry service and reference the same IP address that you see.

You can verify that this is a Microsoft tool by using another Microsoft tool called Process Explorer (download this from Microsoft, search for Process Explorer and SysInternals - a great suite of tools for digging into the OS). Running Process Explorer, you can view all of the running processes on your system, what company created them, and whether they are digitally signed (run Process Explorer, choose displayed columns - add Company Name and Verified Signer, then select Options - Verify Image Signatures). This will check that the running processes are coming from officially valid files from the publishers. If the image is digitally signed, it's either a good Microsoft product or Microsoft's code signing certs have been compromised and we're all in a world of hurt ;)

You can try to disable this and other Windows telemetry by opting out of the Application Experience program, but some telemetry functions continue to run in Windows 10. Another researcher proposed 'sink-holing' the telemetry traffic by blocking the routing to this IP ( http://sphughes.com/2015/09/04/block-microsoft-telemetry-using-null-routes/ ) - but of course, Microsoft would prefer that you did not do that.

Answer 2

I don't do much work on Windows but can share a few pointers:

I reset my computer, cleaned all the drives and reinstalled Windows 10. I thought whatever virus I had should have gone away

Am taking your word for it that it is malware; can't verify properly (searching on Google is only the first step) without a sample.

Some malware can persist beyond reinstallation. I have not come across support scammers using them though. We cannot rule out the existence of this malware prior to the scam incident.

TCP 192.168.1.9:49793 111.221.29.254:443 ESTABLISHED 6752 Is there anyway I can block this IP from connecting to my computer? Is there anyway I can block this IP from my router?

This indicates that this is an outbound (egress) connection. So your computer is connecting to it (this is normal for malware) - not the other way around.

Yes, you should be able to block it both from your computer using Windows Firewall -> Advanced Settings -> Outbound rules -> Actions Tab -> New rule. Microsoft articles are a tad less than helpful, but you could try this one.

However, if your computer is indeed infected but malware that persists beyond reinstalls, I wouldn't trust the OS on your computer at all. So it is better to block it on your router. Use a similar firewall setting (as with the windows firewall above) on the router too - in the outbound connections section.

Many home routers are notoriously insecure and could be a vector in infecting your computer, but that's a different line of paranoia.

Depending on how much it impacts you, I'd suggest you get a security pro to take a look your setup. Some IT pros are good at security, some are not. It's hard to tell the difference, so that's a hurdle for you too.

Good luck.