Do I have a trojan?

[Suspicious-Teach8788]

I want to start off by saying I'm pretty saavy with software and hardware, so it's not usual for me to get infected. I've been infected once and that was because I downloaded something that looked like an MP3 off of Kazaa. It was a VBS. I knew to delete it right away but instead of a single click + delete, I hit double click and yea.. That was 5 years ago. A quick format fixed things though (thank goodness).


I just reformatted recently because I figured my 1 year old Windows XP is getting a little sluggish and I didnt keep up with my 6 months reformatting standards.

I'm running Kaspersky with a very updated database.

And recently I noticed that while playing Warcraft 3 I get a lot of lagouts. What happens is my network starts going crazy (and it's from my PC). I notice a lot of packets being sent from my end (6000/refresh.. does it refresh every second in the network monitor or what), and so it seems like upstream data only. Nothing is coming back though.

It slows my network access to a crawl and the router seems to get overlaoded too as my laptop cannot access any webpages. Once I pull the plug from my desktop, my laptop works again.

I looked into this by loading up PeerGuardian and I noticed that it comes as a bunch of outward access requests from various ports of my computer trying to go to 1 IP address.

Sounds suspiciously like a trojan.

That IP however is non functional (as in I can't get it to respond to ping requests... but maybe it's just firewalled). Either way I see no response and downstream data from that IP when my network goes haywire. And this can happen maybe 2 - 3 times in a day. Each time the IP is different. It usually goes away on its own too (this massive upstream flow) if I leave it alone.

Sometimes I come back to my computer after a few hours and I see my packets jump up to 3 million, so I know it's done this whole upstream thing a few times.

I installed Adaware and I did a scan. Nothing.
Kaspersky did a system scan and a C: scan. Nothing. I'm not sure about scanning the other 960gb I have, but I'm sure it should be fine.

Bottom line is I just don't want to reformat again after spending so many hours customizing my icons...

 

[Muadib]

Dude, how the heck can you say your other 960gb are fine if you didn't scan them.

 

[Schadenfroh]

Kazaa

Using that adware infected application is not a good idea.

instead of a single click + delete, I hit double click

Consider using NoScript to prevent this

I looked into this by loading up PeerGuardian and I noticed that it comes as a bunch of outward access requests from various ports of my computer trying to go to 1 IP address.

Almost sounds like your computer has turned into a Zombie launching DoS attacks, but it seems like it would constantly be doing this rather than just three times a day. What process is eating your CPU up when your network activity spikes?

A few things to try:
[*]Running Mcafee's command line scanner in safe mode
[*]Fully update and run SUPERAntiSpyware and a-squared in safe mode.

Scan everything with Kaspersky and these tools (heuristics, if applicable, maxed out), not just your windows folder.

 

[Suspicious-Teach8788]

Originally posted by: Muadib
Dude, how the heck can you say your other 960gb are fine if you didn't scan them.

Because those are data drives where my music, movies, tv shows and games go. Almost all installations go into c:, my OS drive. I've scanned both C: and D: my XP and Vista partitions, but now I'll scan everything else for the heck of it.

Scadenfroh: Yeah.. that Kazaa incident is over 5 years old, back on my ancient computer. I was using Windows 98SE or something back then and since then I've reformatted that computer at least a dozen times.

When network activity spikes, nothing eats up my processes. I look it up instantly and I end the ones I deem uneccessary, and I've googled a few of the other processes, and everything looks good.

If I load up PeerGuardian, that thing spikes to 50% as it's trying to list every single network access request.

It may be more than 3 times aday. I first thought my Warcraft 3 was infected with something funny, but when I left my computer on for 6 hours once and came back I found my packets jumped to 3 million. Obviously something's wrong. Anyways it's just periodic.

I've found that disabling my network adapter and then re-enabling it maybe 10 min later or even 5 min later will fix the problem.

I'm scanning with Kaspersky as we speak and I'll let you. I'll run the other applications a little later.

If I can't find anything I'll reformat this weekend. =)

 

[bsobel]

DO NOT CROSS POST. This belongs in the security forum, you already started it there, so please monitor that thread (with 7k+ posts you should know better)

 

[bsobel]

Originally posted by: DLeRium
I want to start off by saying I'm pretty saavy with software and hardware, so it's not usual for me to get infected. I've been infected once and that was because I downloaded something that looked like an MP3 off of Kazaa. It was a VBS. I knew to delete it right away but instead of a single click + delete, I hit double click and yea.. That was 5 years ago. A quick format fixed things though (thank goodness).


I just reformatted recently because I figured my 1 year old Windows XP is getting a little sluggish and I didnt keep up with my 6 months reformatting standards.

I'm running Kaspersky with a very updated database.

And recently I noticed that while playing Warcraft 3 I get a lot of lagouts. What happens is my network starts going crazy (and it's from my PC). I notice a lot of packets being sent from my end (6000/refresh.. does it refresh every second in the network monitor or what), and so it seems like upstream data only. Nothing is coming back though.

It slows my network access to a crawl and the router seems to get overlaoded too as my laptop cannot access any webpages. Once I pull the plug from my desktop, my laptop works again.

I looked into this by loading up PeerGuardian and I noticed that it comes as a bunch of outward access requests from various ports of my computer trying to go to 1 IP address.

Sounds suspiciously like a trojan.

That IP however is non functional (as in I can't get it to respond to ping requests... but maybe it's just firewalled). Either way I see no response and downstream data from that IP when my network goes haywire. And this can happen maybe 2 - 3 times in a day. Each time the IP is different. It usually goes away on its own too (this massive upstream flow) if I leave it alone.

Sometimes I come back to my computer after a few hours and I see my packets jump up to 3 million, so I know it's done this whole upstream thing a few times.

I installed Adaware and I did a scan. Nothing.
Kaspersky did a system scan and a C: scan. Nothing. I'm not sure about scanning the other 960gb I have, but I'm sure it should be fine.

Bottom line is I just don't want to reformat again after spending so many hours customizing my icons...

Can you tell what process on that box is generating all the network traffic?

 

[mechBgon]

I wonder if it could have to do with this: Peer-to-peer networks co-opted for DOS attacks


/ idle speculation