75
Why does my pc make so many connections? (europe.pub)
submitted 1 year ago* by to c/privacy@lemmy.ml
37 comments fedilink hide all child comments
 

Hello all,

According to the Wireshark record my computer connects to various services often, including Amazon, Hetzner, 1337 Services GmbH, Evanzo GmbH and ThomasFamilyInvestments. The most often were the connections to mail.my-mail.rocks which is a part of Netcup GmbH. I have a somewhat minimal distro and the attached recordings were made when no app was open including no browser. I can send the other screenshots showing other connections too. I'm suspecting of malware since some time ago but can you help me clarify these connections please?

you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 1 year ago (9 children)

That screenshot just looks like a computer (.100, is that you?) dialing the upstream device (a zyxel!), it doesn’t seem to show what the intended recipient is. If you’re running windows then the start menu ads do crazy stuff. Also I asked if that last local ip octet is you because wireshark will show you other computers traffic coming across its wireless interface.

From a high port to a low port makes me think it’s someone else on your network doing piracy.

  • permalink
  • fedilink
  • source
  • hideshow 9 child comments
    •
  • [–] [S] 3 points 1 year ago (8 children)

    Yes, .100 is me. I have a Zyxel router, should it show the intended recipient? I'm running Linux. What do you mean by a high port to a low port? I also think there is a malware.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 3 points 1 year ago (7 children)

    If you think there’s malware then just wipe and reinstall.

    If you wanna find out what the computer is connecting to, post the wireshark logs.

    Amazon, hetzner and Evanzo are hosting providers, krebs seems to think 1337 services is a scammy site/company and thomas is a shell company. My-mail.rocks has some tor nodes.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 1 year ago (6 children)

    Exactly my point. Just share the actual wireshark log. You record a few seconds and then stop. And then share the log.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] [S] 1 point 1 year ago* (last edited 1 year ago) (5 children)

    I'm not just trying to get rid of the malware but also understand what it's doing. Besides, wiping the system doesn't help as some viruses can permanently corrupt bios. So before wiping out, I think it's a good idea to know what's going on my pc and where do my data go, if there is a malware. I'm a rookie with network monitoring, that's why I'm trying to learn from more experienced users. Here is the part of the original capture: https://limewire.com/?referrer=pq7i8xx7p2. I will disable tor and close all apps along with some serviced and record again. I will let you know, thanks for your help

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 3 points 1 year ago (2 children)

    I can’t see that link. Just drop the log in a paste bin or something.

    You’re probably not in a position to figure out what the malware is doing, or even if you have malware running.

    If you brought me your computer and said “I think I have malware and I want to understand what’s happening” I would remove the drive, image it using an appliance instead of a computer and put the image in a forensic environment so I could observe it safely.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •