4

*Note: My question is quite specific to my situation. Although there may be an answer out there, I am unsure how to search it. *

I am curious to understand more about optimizing my internet speed for my home computer and thus often check on outgoing connections and seeing what apps are operating at the moment. I do this to make sure new software doesn't have auto updates or cloud services that I didn't explicitly know about. Ex. Skype keeps wanting to login or update but i simply want it there for should it be an only means to reach someone. But i digress.

So this leads me to my main question. After very little research i found out about rootkits and there ability to "trick" the system with false information. I looked this up when noticing a discretion between my resource monitor and the task managers Performance tab. id like to note here that this is Win 10 Home edition. anyway, the connections that i have incoming on my ResMon is tremendously low compared to the Perf tab. I have included a Pic of these two as they stood side by side. Screenshotted at the same time.

So my question is that could i have something malicious going on, or is there a logical explanation for how the system works.

1

  • Most rootkits don't have a high download, as that makes the rootkit authors suspicious without providing them with any useful information, most rootkits instead send your private data or encrypted files. – Ferrybig Aug 13 '17 at 13:01
  • 3
    Also, task manager shows the data usage in megabits per second, and resource manager shows it in bytes per second, making both values more close than it looks at first glance – Ferrybig Aug 13 '17 at 13:02
  • 3
    To expand on what @Ferrybig said, 121860 Bytes/s * 8 = 974880 bits/s ~= 1 Mbit/s, which isn't "tremendously low" compared to the 1.4 Mbit/s figure, and within measurement margin of error (when you take into account averaging periods, etc.). – Bob Aug 13 '17 at 16:04
5

Rootkits and other backdoors

Short answer:

  • It depends on your personality, if you prefer security or comfort.
  • If you prefer comfort, you can download some free antivirus programs for Windows, or pay for some of them, and believe their reports. Than do not worry.
  • If you care about security, it is an insignificant question if you have a specific rootkit/virus running on your Windows computer, because it is very probable, that you have at least 2 or 3 built-in backdoors, and the long term solution will be leaving certain companies, like Microsoft and Google. You should expect no security or privacy with Skype, Windows or well known computer/phone brands.

Long answer:

  • I do not know in this specific situation, if you have Computrace, but I heared, that on Win machines it constantly keeps phoning back to company servers, which can be the reason of net traffic. Look for rpcnet.exe and similars. I do not know if it really works to block computrace on Win any more. Depends on your situation. Computrace is practically a built in BIOS spyware/backdoor for most modern computers which can monitor and take control over our device, like wiping the whole drive, etc. You should especially suspect this if you bought a used device.
  • The next I would say firmware spyware/backdoors, they are also official programs controlling your machine, like audio drivers, support apps and similar phising bloatware preinstalled andor needed for proper functioning.
  • It can be also Skype, try uninstalling it, and it will cause less crash, lag and probably net traffic too. Sometimes it also acts like a spyware.
  • Minimal traffic is normal when firefox is running. If you installed other apps, they also might call servers time to time.
  • If you have no backups, do that now, do a reinstall, do a virus check on the fresh system and your saved files, and start everything new with new passwords. This is the safest what you can do on Windows.

Tip/Solution:

Most of these things can be resolved by using Linux, and there are much more easy-to-use distributions in 2017.

  • It does not have to use Skype, there are opensource, multiplatform/protocol secure chat programs.
  • Linux is less popular and harder to attack by viruses.
  • It is opensource, so harder to implement backdoors, unlike with Microsoft.
  • Linux has opensource firmwares, therefore the preinstalled spywares are deleted when you wipe your drive, and not needed to control your device.
  • Even computrace does not seem to work with Linux. You can not erase it easily from the BIOS, but it will be incapable to run.
  • There are opensource BIOSes outthere on limited hardware, but it usually needs hardware level knowledge.

Feel free to ask.

  • I definately appreciate the reply. I do have a few distros of ubuntu and kali. ive simply prefer windows because it tends to have apps that i use more. stuff that wine doesnt work well with or simply put, just does not compute. – Nate Aug 13 '17 at 10:04
  • Thanks. Than it was a bit offtopic. I understand, but it worths to change now n 2017, there are professional tools for artists, engineers, businessmen, or high-eng games, you can enjoy. - youtube.com/watch?v=TqZeThC38ug - youtube.com/watch?v=W6tEolVz3_4 - youtube.com/watch?v=SqCzaCJN0Xg What do you need Windows for exactly? Otherwise you can still download free rootkit detector programs for Win, one of the best antivirus is BitDefender. – TriloByte Aug 13 '17 at 14:08
  • 5
    "Nuke everything and move to Linux", while somewhat effective in some situations, is not a good or adequate answer to this question, in my opinion. Your answer does not even try to answer the question, and could be posted in reply to almost any question about viruses and such. – Akiiino Aug 13 '17 at 19:58
  • While security points of Linux are great, to completely deny Windows, is not really fair. Why do we need Windows? Comfortability, years of usage every accessible. It is made for simple end-users. – Josh Ross Aug 14 '17 at 6:40
  • @Akiiino: 1. I already remarked upon my answer being possibly offtopic for the Asker because of the distance of the viewpoint. 2. If you read my answer, you also saw different tips related to the exact topic. There is no point in repeating what Sas3 has already written. 4. I personally see not much point in talking about upper level security, when you have known BIOS and WIN backdoors + possible rootkit in your system - you can not trust 100% any measurments by that system. Also that is why I voted his answer up. 4. Acually it is you, who did not contribute to the topic. – TriloByte Aug 14 '17 at 18:31
2

There are several good explanations that others brought up.

  • Rootkit
  • Backdoor in the OS
  • Discrepancy between units of measurement (1 Mbs is not the same a 1 MB/s, 1 MB/s is 8 Mbs)
  • You may not be seeing traffic from other users (are you running as Administrator?)
  • Average reading vs instantaneous reading

However, there is also another possibility that I will bet on in your particular case:

  • non-TCP/IP traffic

As a proof of concept I performed a ping flood from a separate machine to my Windows machine. On Windows I saw ~50 Mbs inbound at the network interface and only 0.1 Mbs at the application level. Apparently the application list shows only TCP/UDP statistics. Ping happens to be ICMP, but there are dozens other common protocols out there too (to name a couple GRE, AH, L2TP etc).

Whether the traffic your're seeing is malicious or not needs further investigation. The way you will really get to the bottom of it is with wireshark. If you capture traffic for a specific time period, you'll see exactly what protocols are responsible for that bandwidth, and as a bonus you will find out what IP endpoints are involved.

1

Data transfer speeds (on the left of your pic) are for very short periods of time and are hard to reconcile with "number of bytes transferred" (on the right).

What you have is the first sign that something is not right. It's not yet a smoking gun, but is probably something to start checking - to see whether something is wrong; and if it is, what it is. It could be rootkit or something else too.

While there are many approaches to investigating, since this is starting with network traffic, you should try capturing network traffic - preferably using another "less untrusted" device. Use a distro like Security Onion to quickly rig up a monitoring system and watch.

There are other lower-barrier steps you could take including checking for malware with something like MalwareBytes. Nothing is totally guaranteed to detect every time, but it is a starting point.

Edit: Corrected the link to Security Onion.

  • thanks for the answer. so if i were to be having malware on here, would there be something injected specifically to alter the Resource mon and not change the Task manager? could that narrow down the playing field so to speak? – Nate Aug 13 '17 at 10:15
  • @Nate They are looking at different things. Task Manager is looking at what goes through the network device and Resource Monitor is adding together the things of the processes that it can see. Have you tried running Resource Monitor as Administrator? – wizzwizz4 Aug 13 '17 at 11:04
  • Security onion link is dead. – Οurous Aug 14 '17 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.