Should I be worried about rootkits?

Question

*Note: My question is quite specific to my situation. Although there may be an answer out there, I am unsure how to search it. *

I am curious to understand more about optimizing my internet speed for my home computer and thus often check on outgoing connections and seeing what apps are operating at the moment. I do this to make sure new software doesn't have auto updates or cloud services that I didn't explicitly know about. Ex. Skype keeps wanting to login or update but i simply want it there for should it be an only means to reach someone. But i digress.

So this leads me to my main question. After very little research i found out about rootkits and there ability to "trick" the system with false information. I looked this up when noticing a discretion between my resource monitor and the task managers Performance tab. id like to note here that this is Win 10 Home edition. anyway, the connections that i have incoming on my ResMon is tremendously low compared to the Perf tab. I have included a Pic of these two as they stood side by side. Screenshotted at the same time.

So my question is that could i have something malicious going on, or is there a logical explanation for how the system works.

Answer 1

Rootkits and other backdoors

Short answer:

• It depends on your personality, if you prefer security or comfort.
• If you prefer comfort, you can download some free antivirus programs for Windows, or pay for some of them, and believe their reports. Than do not worry.
• If you care about security, it is an insignificant question if you have a specific rootkit/virus running on your Windows computer, because it is very probable, that you have at least 2 or 3 built-in backdoors, and the long term solution will be leaving certain companies, like Microsoft and Google. You should expect no security or privacy with Skype, Windows or well known computer/phone brands.

Long answer:

• I do not know in this specific situation, if you have Computrace, but I heared, that on Win machines it constantly keeps phoning back to company servers, which can be the reason of net traffic. Look for rpcnet.exe and similars. I do not know if it really works to block computrace on Win any more. Depends on your situation. Computrace is practically a built in BIOS spyware/backdoor for most modern computers which can monitor and take control over our device, like wiping the whole drive, etc. You should especially suspect this if you bought a used device.
• The next I would say firmware spyware/backdoors, they are also official programs controlling your machine, like audio drivers, support apps and similar phising bloatware preinstalled andor needed for proper functioning.
• It can be also Skype, try uninstalling it, and it will cause less crash, lag and probably net traffic too. Sometimes it also acts like a spyware.
• Minimal traffic is normal when firefox is running. If you installed other apps, they also might call servers time to time.
• If you have no backups, do that now, do a reinstall, do a virus check on the fresh system and your saved files, and start everything new with new passwords. This is the safest what you can do on Windows.

Tip/Solution:

Most of these things can be resolved by using Linux, and there are much more easy-to-use distributions in 2017.

• It does not have to use Skype, there are opensource, multiplatform/protocol secure chat programs.
• Linux is less popular and harder to attack by viruses.
• It is opensource, so harder to implement backdoors, unlike with Microsoft.
• Linux has opensource firmwares, therefore the preinstalled spywares are deleted when you wipe your drive, and not needed to control your device.
• Even computrace does not seem to work with Linux. You can not erase it easily from the BIOS, but it will be incapable to run.
• There are opensource BIOSes outthere on limited hardware, but it usually needs hardware level knowledge.

Feel free to ask.

Answer 2

There are several good explanations that others brought up.

• Rootkit
• Backdoor in the OS
• Discrepancy between units of measurement (1 Mbs is not the same a 1 MB/s, 1 MB/s is 8 Mbs)
• You may not be seeing traffic from other users (are you running as Administrator?)
• Average reading vs instantaneous reading

However, there is also another possibility that I will bet on in your particular case:

• non-TCP/IP traffic

As a proof of concept I performed a ping flood from a separate machine to my Windows machine. On Windows I saw ~50 Mbs inbound at the network interface and only 0.1 Mbs at the application level. Apparently the application list shows only TCP/UDP statistics. Ping happens to be ICMP, but there are dozens other common protocols out there too (to name a couple GRE, AH, L2TP etc).

Whether the traffic your're seeing is malicious or not needs further investigation. The way you will really get to the bottom of it is with wireshark. If you capture traffic for a specific time period, you'll see exactly what protocols are responsible for that bandwidth, and as a bonus you will find out what IP endpoints are involved.

Answer 3

Data transfer speeds (on the left of your pic) are for very short periods of time and are hard to reconcile with "number of bytes transferred" (on the right).

What you have is the first sign that something is not right. It's not yet a smoking gun, but is probably something to start checking - to see whether something is wrong; and if it is, what it is. It could be rootkit or something else too.

While there are many approaches to investigating, since this is starting with network traffic, you should try capturing network traffic - preferably using another "less untrusted" device. Use a distro like Security Onion to quickly rig up a monitoring system and watch.

There are other lower-barrier steps you could take including checking for malware with something like MalwareBytes. Nothing is totally guaranteed to detect every time, but it is a starting point.

Edit: Corrected the link to Security Onion.