5

While debugging my web application in Fiddler, I found out that there are some suspicious requests to some hotel sites, search requests to google.pl. etc. See below images. Strangely there no process displayed in Fiddler.

Fiddler network packet trace Suspicious packet Fiddler network packet trace

It's definitely a virus. I don't know how to find out which software or process is causing it. Any help to further analyze and secure my system is highly appreciated.

  • Maybe other tools like microsofts network monitor show the process? – user78244 Jun 26 '15 at 12:22
  • 3
    If your are using windows then try using the netstat -b to see what executable is making requests – ρss Jun 26 '15 at 12:50
1

You won't see a process if the request is not from the local machine, I.E., if you are allowing other machines to proxy via Fiddler. Check the Tools | Telerik Fiddler Options menu, and on the Connections tab, see if "Allow remote computers to connect" option is checked. If it is, this is likely where these requests are coming from, and why you can't identify the process they're associated with.

0

Microsoft's TCPView will show the link between processes and network connections:

https://technet.microsoft.com/en-us/library/bb897437.aspx

  • 1
    used this, looks good however problem is that those connections closes very fast. by the time I observe and click on it it vanishes. Luckily I could click on one ( I think I did ) but it says system and PID is 0. also some says netbios – Kiran Ambati Jun 30 '15 at 5:54
0

You can try:

netstat -abn

Which will show the process, if available.

You can also try:

netstat -aon

Which will show the PID which you can then lookup in the task manager.

However, it may not show up in either of those places depending upon how stealthy it is. If it doesn't show up there are techniques to use things like Logman logging Winsock activity, but it gets a little complicated from there.

  • Both commands dint give much info. probably because connections is not continuous it is connecting and closed in a split second. – Kiran Ambati Jun 30 '15 at 5:51
  • 1
    For the time being, you could add an entry in your hosts file to route www.google.pl to 0.0.0.0 until you can track this thing down. – k1DBLITZ Jun 30 '15 at 13:23
  • Good idea!. This will reduce one url :) – Kiran Ambati Jun 30 '15 at 19:18
0

I would suggest Sysinternals: https://technet.microsoft.com/en-us/sysinternals/default.aspx.

These tools are good to have in your toolkit when investigating odd behavior:

TCPView

TCPView will show you open connections and let you force close connections.

Autoruns

This program shows you programs that are set to start on boot and will let you remove them from autostarting. Windows has a number of places that programs can get injected to autostart.

Process Explorer and Process Monitor

These programs allow you to view running processes, ownership information, open files and open ports, dump memory owned by the process, and let you kill these programs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.