My wife's computer was recently compromised and I have tried to clean it.

I installed Microsoft Network Monitor to see if there was any unexplained internet traffic and I noticed a connection to Dropbox. Here is the given details:

URI: /subscribe?host_int=34404476&ns_map=162130732_8752065324,26351085_36339744642541,129513375_382381602719&user_id=16845707&nid=0&ts=1386575431

Host:  notify8.dropbox.com

Process Name Dropbox.exe

Note, neither myself nor my wife use Dropbox. I checked the install date for the instance of Dropbox that is on her machine and it has an install date of May this year, so this was probably not installed as part of what ever virus etc. infected the machine.

I tried to do a reverse lookup on the IP and I got nothing.

Does this look like my wife's machine is trying to connect to a particular Dropbox account to retrieve some software (possibly malicious)?

  • The IP: is within Dropbox.
    – dan
    Dec 9, 2013 at 9:03
  • Please clarify your diagnosis: "so this was probably not installed as part of whatever virus...".
    – dan
    Dec 9, 2013 at 9:04
  • Please add how you diagnosed your system compromise?
    – dan
    Dec 9, 2013 at 9:05
  • @danielAzuelos - Long story, but I installed a piece of software and then my browser settings were all screwed and I then ran Security Essentials which detected a trojan.
    – going
    Dec 9, 2013 at 10:08
  • Two questions: 1. When your wife logs into her Dropbox account online, what does she see. 2. Where did the Dropbox application come from ?
    – KingJohnno
    Dec 9, 2013 at 14:43

2 Answers 2


If your system has been taken over an attacker could manipulate the install dates of any software, so anything you see on a hacked system must be treated with doubt. The IP address you listed is a valid dropbox IP, however that means nothing - if I was writing malware I'd seriously consider using dropbox to distribute it. It's robust, completely free, and people are likely to discount it as a threat vector: "Oh that's just dropbox, don't worry about it."

So it is entirely possible that the malware installed uses a dropbox labelled process to actually connect to dropbox and download latest versions of malware and operating instructions, although that scenario is not particularly likely. It is much more likely that this is actually a completely legitimate dropbox installation that you don't remember installing, and therefore a red herring. Unfortunately, there's no way to know for sure as once a system is hacked you can never trust it again. Your best bet is to wipe your system and start over.


To answer your question, it does seem that your wife's laptop is trying to connect to that IP. Reboot the machine, and without opening a browser, run netstat -ano from the command prompt.

If you see the IP there - or any dodgy connection for that matter from this command's output, take note of the PID (Process Identifier) associated with this connection from the fifth column. Then, open Task Manager (using Ctrl+Shift+Esc), and, go to View -> Select Columns....

A new Select Columns dialog box will pop up; tick/check the second item PID (Process Identifier). If you find the same PID that you took from the netstat -ano's command, this PID will most likely be related to a process, which might serve as a clue as to which file is initiating the connection.

You can then reboot the computer in Safe Mode and remove the file, if you are confident this will not break your OS.

Also, you can check a few standard locations. Please check this question I once asked: it might provide some insight.

Re-run some anti-virus scan.

You can also block this IP from coming in or going out your perimeter firewall.

Having said all that, this is all fine if you are just wanting to play about and see the places where the malware can interact with. Still the recommended course of action is a full Nuke of your OS. I would definitely not leave my wife's laptop with some dodgy leftovers.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .