0

For the past two weeks, I wasn't able to use some of the software installed on my computer (e.g. Visual Studio). There is a process that is communicating with IP address 185.82.212.95 over port 8080. All of the packets from this IP are stuck in SYN_SENT status. Because of this, I can't even install a plugin on Visual Studio.

When I looked up the owner, this is what I found. enter image description here

This IP address is tied to many processes when I look it over netstat -nab output, over the same port.

How do I identity if this is really a virus? How do I find out which program is actually using it (the one from the task manager is svchost.exec which I don't think is true)? How do I uninstall this program if it is a virus?

On some IP abuse websites, this IP address is marked as spam. For example, check this out: Link

Any help would be greatly appreciated.

Thank you.

0

I've done some digging for you and although I am not 100% sure this is the case it might be worth checking out. Since you did not specify what operating system you're using, I am going to assume it is Windows.

A quick port scan reveals the following:

5222/tcp open     jabber       ejabberd (Protocol 1.0)
| xmpp-info: 
|   STARTTLS Failed
|   info: 
|     unknown: 
| 
|     stream_id: 6622689145227766353
|     xmpp: 
|       lang: en
|       server name: localhost
|       version: 1.0
|     capabilities: 
| 
|     features: 
| 
|     auth_mechanisms: 
| 
|     compression_methods: 
| 
|     errors: 
|       host-unknown
|       host-unknown
|_      (timeout)
5269/tcp open     jabber       ejabberd
| xmpp-info: 
|   STARTTLS Failed
|   info: 
|     unknown: 
| 
|     stream_id: 10375863078716023551
|     xmpp: 
|       version: 1.0
|     capabilities: 
| 
|     features: 
|       TLS
|     auth_mechanisms: 
| 
|     compression_methods: 
| 
|_    errors: 

This confirms that a jabber server is running on the host. The malware Win32/Jabberbot.A for example uses the XMPP protocol.

How do I identity if this is really a virus?

The data you looked up and posted here seems a fair indication that something malicious is going on.

Things to consider:

  1. Block the IP address using a firewall (Windows firewall)

  2. Install / update your anti-virus scanner and execute a full scan.

If the used anti-virus software doesn't find anything, try one or more other anti-virus scanners.

  • Ultimately, if the virus is persistent, it is likely to be easier to do a full reset of the PC back to a safe, factory build. Then make sure the virus hasn't persisted. Then reinstall your software and data, making sure to use known, good, legitimate versions of software and taking care with data file types known to have potential issues. Follow standard guidelines for securing Windows PC's & block 3rd party cookies and adverts. – Julian Knight Nov 12 '17 at 12:56
  • Thank you @jeroen-it-nerdboxand and Julian. I scanned my machine using different antivirus software and nothing was found. I am going to do a fresh install of my operating system as Julian suggested, it should eliminate the problem altogether. Thank you all for your input. – khalidcawl Nov 13 '17 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.