Unknown proxy blocking connections over port 8080

Question

For the past two weeks, I wasn't able to use some of the software installed on my computer (e.g. Visual Studio). There is a process that is communicating with IP address 185.82.212.95 over port 8080. All of the packets from this IP are stuck in SYN_SENT status. Because of this, I can't even install a plugin on Visual Studio.

When I looked up the owner, this is what I found.

This IP address is tied to many processes when I look it over netstat -nab output, over the same port.

How do I identity if this is really a virus? How do I find out which program is actually using it (the one from the task manager is svchost.exec which I don't think is true)? How do I uninstall this program if it is a virus?

On some IP abuse websites, this IP address is marked as spam. For example, check this out: Link

Any help would be greatly appreciated.

Thank you.

Answer 1

I've done some digging for you and although I am not 100% sure this is the case it might be worth checking out. Since you did not specify what operating system you're using, I am going to assume it is Windows.

A quick port scan reveals the following:

5222/tcp open     jabber       ejabberd (Protocol 1.0)
| xmpp-info: 
|   STARTTLS Failed
|   info: 
|     unknown: 
| 
|     stream_id: 6622689145227766353
|     xmpp: 
|       lang: en
|       server name: localhost
|       version: 1.0
|     capabilities: 
| 
|     features: 
| 
|     auth_mechanisms: 
| 
|     compression_methods: 
| 
|     errors: 
|       host-unknown
|       host-unknown
|_      (timeout)
5269/tcp open     jabber       ejabberd
| xmpp-info: 
|   STARTTLS Failed
|   info: 
|     unknown: 
| 
|     stream_id: 10375863078716023551
|     xmpp: 
|       version: 1.0
|     capabilities: 
| 
|     features: 
|       TLS
|     auth_mechanisms: 
| 
|     compression_methods: 
| 
|_    errors: 

This confirms that a jabber server is running on the host. The malware Win32/Jabberbot.A for example uses the XMPP protocol.

How do I identity if this is really a virus?

The data you looked up and posted here seems a fair indication that something malicious is going on.

Things to consider:

1. Block the IP address using a firewall (Windows firewall)

2. Install / update your anti-virus scanner and execute a full scan.

If the used anti-virus software doesn't find anything, try one or more other anti-virus scanners.