5

I'm having a problem with one of my computers. I suspect it's being used for something malicious.

A few weeks ago my internet connection went down, I called my ISP and they told me that no MAC address could be received from my computer, but a day later the internet went back online, only this time there was an unidentified public network connected via internet to my computer, and the light on my motherboards network adapter was glowing red even though traffic came through.

At first I didn't give it much thought, just reset the internet connection when the network popped up. It did so randomly, sometimes 2-3 times a day, sometimes once every few days.

Yesterday I decided to look into it and found out the network was sending huge amounts of information to and from my computer, 180MB received, 30MB sent over a period of 20 minutes when my computer was idle, having no other established connections other than to that network.

I decided to take a look at the traffic using WireShark and found out a lot of PDU parts being sent to me from the IP I was connected to, and random queries sent out to a couple of other IP's from my computer.

I did a full format erasing everything to see if I could solve it, but somehow the network is still there sending data.

I'm in way over my head here, so I would appreciate if you guys could shed some light on this.

Improve this question
11
  • Interesting. Try running a Wireshark capture for ~half an hour and have a look at the packets collected to see if you can make sense of what it is that is sent out. Seeing that your computer is still sending out data after formatting your drive puzzles me.
    – Henning Klevjer
    Dec 8, 2012 at 16:17
  • Just to get this clear: You reinstalled your OS and formatted the whole drive and you still have this problem? Did you try, since you reinstalled anyway, installing Linux? :p
    – cooky451
    Dec 8, 2012 at 16:42
  • Roger that, I'll leave wireshark on for half an hour! @Cooky451: When I reinstalled I formatted the drives by hooking them up to a computer running ubuntu 12.04, I wiped those drive as clean as I knew how to make em. I also had a Ubuntu installed on the effected computer via dual booting with GRUB, the network existed when running ubuntu as well.
    – user16876
    Dec 8, 2012 at 17:00
  • 1
    I share a router with someone. He had the same problem today. He didn't try wiping everything, but we found the IP address, it was IPv4 in a distant land. We blocked that IP address in his firewall, using Komodo (Comodo?). We set it to block any connection, send or receive from that IP. So far, so good, but that doesn't solve the problem longer term. I hope someone can help you, as I would like to know too!
    – Ellie Kesselman
    Dec 9, 2012 at 10:37
  • Any news, @user16876?
    – Henning Klevjer
    Dec 9, 2012 at 12:26

2 Answers 2

Reset to default
1

It's interesting that you started to see this after your internet link went down and was restored. It's possible that they are incorrectly routing traffic down your internet link, and that's why you are seeing the increase in traffic. Try calling your ISP and asking them to verify that they aren't routing another subnet down your link.

Improve this answer
1
  • I'll give their support a call tomorrow then! Thanks!
    – user16876
    Dec 9, 2012 at 12:44
0

Depending on the type of internet connection, if they are using passive fiber, (used by many cable and fiber ISPs) then your cable or fiber modem would be receiving information for everyone on your passive distribution (about 32 customers generally). Normally the modem filters out any traffic that isn't bound for your modem, but a misconfiguration could cause it to push more through.

What did you use to identify the amount of data being sent and what do you mean by having an unidentified public network? Did your normal network connection simply say it was connected to an unidentified network? This would most likely suggest a change in modem configuration if you are not using a router on your internal network.

Improve this answer
4
  • What i used to identify the amount of data was windows standard network information window, looking at the sent and received numbers. Regarding unidentified network windows simply said there were 2 networks connected to my computer, the ordinary one, my home network, and an unidentified public network connected via internet. The unidentified network popped up at system start, and would shut down if I pulled the ethernet cable out, when i plugged it back in again, it was gone. Looking at the connections using netstat showed that the computer was still connected to someone though.
    – user16876
    Dec 11, 2012 at 17:22
  • Sorry for double post, ran out of characters. My home network configuration is fairly simple, It's just my computer connected to a wall outlet via an ethernet cable. No router or switches.
    – user16876
    Dec 11, 2012 at 17:27
  • Get yourself a $25 router. It doesn't need WiFi. Put it between your computer and the wall jack (of your apartment complex I presume). It will act as a NAT firewall, blocking all incoming attempts to connect to your computer. Unless you have malware on your computer, you should be safe.
    – Tom Robinson
    Dec 17, 2014 at 6:02
  • ps Do you have Skype? It will use your computer as a node for relaying traffic among other Skype users who are not related to you. The NAT firewall will stop that.
    – Tom Robinson
    Dec 17, 2014 at 6:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .