7

I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes.

A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to change my password. So I did, and went on with my business. All fine and dandy, until about a week or two ago. My Skype name had suddenly changed to "Dick" instead of "Dirk". It couldn't have been any of my coworkers, considering my laptop hadn't been turned on prior to it happening. Later, the same thing happened to my Hotmail account, Hotmail claiming "there had been an unusual amount of spam and/or junk mail coming from my address". Ever since this point, I've been a little paranoid and changed every single important password.

It had gotten me a little curious, so I went out out of my way to regularly monitor the active connections and bandwidth usage. Most of the time, the usual: Skype, Chrome, my games etc. However, I was just checking again and there were an unusual amount of (assumingly) failing connections coming from the same IP address, with incrementing ports each time. I'm by no means an expert in networking (hence this question), but this most definitely raised a red flag for me.

Here's a screenshot of it. By the way, "Kan gegevens van de eigenaar niet verkrijgen" roughly means "Cannot retrieve data from the owner".

Should I be wary or am I fine? If I'm not, what should I do?

Thanks in advance.

| improve this question | |
  • 1
    Skype name changed from "Dirk" to "Dick"? You've (most probably) been RAT-pwned by a "skid". That means a huge possibility of a DarkComet infection (that's what all skids use, y' see). Try looking for ways to remove it if your AV can't handle the situation. – Mints97 Feb 21 '15 at 17:11
3

If you find such unusual traffic again, use tcpview to find the application which generates/listens to that suspected traffic, tcpview is capable of giving you the path to the application listed in its view. Test the respective application with your updated anti-virus software or upload to online virus scanning tools. More detective work on any process could be done using Process Explorer. Check the start-up applications during system bootup or login this could be done with Autoruns for Windows. Think before you re-installing the OS.
One I had similar situation and end up finding a Trojan horse in my pc, OS re-installation was not necessary in that case.

| improve this answer | |
  • It's really hard to know when your machine is "clean" unless you're running a full blown IDS on your home network. isc.sans.edu/diary/… – k to the z Mar 25 '13 at 22:27
2

I'm not sure if its legitimate or not considering I do not know what is running on your machine. The ips are owned by Akamai which provides SaaS.

If you are uncertain your machine had been breached I would at least do a virus scan with a live cd ( kaspersky has one for free). However the best method, if you are up to it, is reinstalling your machines and resetting all your passwords afterwards.

| improve this answer | |
  • Akamai also provide content distribution - in fact they're one of the big CDN companies. I'd expect these outbound connections are probably just fetching images etc from websites, and not anything malicious. – user2213 Mar 25 '13 at 12:24
  • I remember when i was super young...looking at my traffic and freaking over akamai and Level3 comms that kept coming up in logs. Turned out it was the AV updating :P Always good to be investigating. On the downside, now whenever i seek akamai i assume its safe! :/ – NULLZ Mar 25 '13 at 13:10
0

The best solution to analyze connections that is if you want to identify something fraudulent or suspicious i recommend that use something like ZONEALARM OR Any other firewall for that matter and make it work in paranoid mode. This would help you identify list of programs/apps/services that goes to internet. This approach will help you white list your connections.

| improve this answer | |
0

I'm not sure what the rules are about reposting on SE, but check out my answer here: How can I tell whether this computer is part of a botnet? It's relevant to your question and the same things apply.

Also, if you're running Windows 7 you can bring up the task manager, click the performance tab, and then click Resource Monitor.

From there click the Network tab and you'll have a fancier GUI version of netstat.

You can also check the Disk tab and see real time which files are being read/written to the disk and where.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.