got a weird question and I'm not sure if I should even post this on here but I couldn't think of anywhere better to ask. Lately, I've been getting some internet speed issues. I closed literally every proccess on my computer that sends packets out regularly, including windows updater, everything. When I ran a wireshark scan I've noticed repeating pattern of packets being sent and received and I'm worried it's some kind of a bot.(90% I'm alright, just wanted your opinion, better be safe than sorry): I don't have stackoverflow reputation so here's a direct link: http://i.imgur.com/5nJbi1K.png?1


That first IP at least is owned by a Russian telecom:

Address lookup

canonical name broadband-46-18-200-212.clients.kubtel.ru. aliases

Queried whois.ripn.net with "kubtel.ru"...

domain: KUBTEL.RU

And considering that many IP addresses are being checked for ICMP in less than 3 seconds, I would say that your assumption about malware on the system is justified.

The address was the first in that list to reply back, but only after it rejected your machine's ICMP probe. Once it knew you were alive and beaconing out, it attempted to connect back to you via TCP 1900, usually reserved for UPnP.

The fact that any of those other hosts are getting through with TCP and UDP to your host inside your LAN is pretty telling about your router's configuration. Do you really allow all communications inbound? DMZ or port forward? The other explanation is that these are continuations of connections started before your capture that your PC initiated.

I would consider this asset compromised, and perform an immediate reimage/reinstall.

  • Thanks a lot for you reply. I checked my router configs, it had its firewall off, and port 80 forwarded. Moreover DMZ was activated to port 80. I turned it all off and from what I can tell my download speed has doubled. Thank you so much! Apr 16 '15 at 6:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.