2

My wife's computer was recently compromised and I have tried to clean it.

I installed Microsoft Network Monitor to see if there was any unexplained internet traffic and I noticed a connection to Dropbox. Here is the given details:

URI: /subscribe?host_int=34404476&ns_map=162130732_8752065324,26351085_36339744642541,129513375_382381602719&user_id=16845707&nid=0&ts=1386575431 Host: notify8.dropbox.com Process Name Dropbox.exe

Note, neither myself nor my wife use Dropbox. I checked the install date for the instance of Dropbox that is on her machine and it has an install date of May this year, so this was probably not installed as part of what ever virus etc. infected the machine.

I tried to do a reverse lookup on the IP 108.160.162.115 and I got nothing.

Does this look like my wife's machine is trying to connect to a particular Dropbox account to retrieve some software (possibly malicious)?

Improve this question
5
  • The IP: 108.160.162.115 is within Dropbox. Commented Dec 9, 2013 at 9:03
  • Please clarify your diagnosis: "so this was probably not installed as part of whatever virus...". Commented Dec 9, 2013 at 9:04
  • Please add how you diagnosed your system compromise? Commented Dec 9, 2013 at 9:05
  • @danielAzuelos - Long story, but I installed a piece of software and then my browser settings were all screwed and I then ran Security Essentials which detected a trojan. Commented Dec 9, 2013 at 10:08
  • Two questions: 1. When your wife logs into her Dropbox account online, what does she see. 2. Where did the Dropbox application come from ? Commented Dec 9, 2013 at 14:43

2 Answers 2

Reset to default
4

If your system has been taken over an attacker could manipulate the install dates of any software, so anything you see on a hacked system must be treated with doubt. The IP address you listed is a valid dropbox IP, however that means nothing - if I was writing malware I'd seriously consider using dropbox to distribute it. It's robust, completely free, and people are likely to discount it as a threat vector: "Oh that's just dropbox, don't worry about it."

So it is entirely possible that the malware installed uses a dropbox labelled process to actually connect to dropbox and download latest versions of malware and operating instructions, although that scenario is not particularly likely. It is much more likely that this is actually a completely legitimate dropbox installation that you don't remember installing, and therefore a red herring. Unfortunately, there's no way to know for sure as once a system is hacked you can never trust it again. Your best bet is to wipe your system and start over.

Improve this answer
2

To answer your question, it does seem that your wife's laptop is trying to connect to that IP. Reboot the machine, and without opening a browser, run netstat -ano from the command prompt.

If you see the IP there - or any dodgy connection for that matter from this command's output, take note of the PID (Process Identifier) associated with this connection from the fifth column. Then, open Task Manager (using Ctrl+Shift+Esc), and, go to View -> Select Columns....

A new Select Columns dialog box will pop up; tick/check the second item PID (Process Identifier). If you find the same PID that you took from the netstat -ano's command, this PID will most likely be related to a process, which might serve as a clue as to which file is initiating the connection.

You can then reboot the computer in Safe Mode and remove the file, if you are confident this will not break your OS.

Also, you can check a few standard locations. Please check this question I once asked: it might provide some insight.

Re-run some anti-virus scan.

You can also block this IP from coming in or going out your perimeter firewall.

Having said all that, this is all fine if you are just wanting to play about and see the places where the malware can interact with. Still the recommended course of action is a full Nuke of your OS. I would definitely not leave my wife's laptop with some dodgy leftovers.

Improve this answer
0

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.