suspicious internet activity in my PC.

[Lalith Jayasinghe]

HI...
My PC started to sending and receiving data every time. even there is no active process in the resource manager.
I have bitdefender installed. I make it's firewall paranoid mode on and made application rules.
I notice that every time i block the firefox , the internet activity(sending and receiving data) stopped.

If i unblock the firefox the Internet activity start again (even if not start the firefox). So i think this problem has a connection to the firefox or it's ports. How can i detect the application which causing this Internet traffic?
I tried resource manager and BD firewall but both them are showing that incoming data increased but not showing any particular application which cause it.
Is this can be a malware doing?
Thank you.

 

[Purshu_Pro]

Try this and tell me, Make sure u run no other application during this task. Your network must be connected.

Please open Bitdefender.From the main window,on the Firewall panel,you have a button called Manage Adapters.Press on
Manage Adapters and from there on set the Network Type to "Home/Office",the Stealth Mode to "off" and Generic to "Yes".

Afterwards please go to Settings->Firewall->Advanced and from there disable "Block Port Scans" and "Intrustion Detection System".From the same window enable "Internet Connection Sharing".

Restart ur PC after this.

 

[Gnosis]

"Learning Mode" maybe? "Cache Builder"??

 

[Lalith Jayasinghe]

Try this and tell me, Make sure u run no other application during this task. Your network must be connected.

Please open Bitdefender.From the main window,on the Firewall panel,you have a button called Manage Adapters.Press on
Manage Adapters and from there on set the Network Type to "Home/Office",the Stealth Mode to "off" and Generic to "Yes".

Afterwards please go to Settings->Firewall->Advanced and from there disable "Block Port Scans" and "Intrustion Detection System".From the same window enable "Internet Connection Sharing".

Restart ur PC after this.

I did it. Still same. Internet activity still happening when firefox rules allowed on the firewall.

 

[Lalith Jayasinghe]

"Learning Mode" maybe? "Cache Builder"??

what you mean ?

 

[TwinHeadedEagle]

Follow this topic and attach requested reports

http://malwaretips.com/threads/malware-removal-assistance-how-to-get-help.20334/

 

[Lalith Jayasinghe]

Follow this topic and attach requested reports

http://malwaretips.com/threads/malware-removal-assistance-how-to-get-help.20334/

Requested Files Attached here.

 

[TwinHeadedEagle]

There are a lot of policies changed, do you know something about this?

 

[Lalith Jayasinghe]

There are a lot of policies changed, do you know something about this?

I have no idea ? can you specific?

 

[TwinHeadedEagle]

Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)

Open FRST, and click Fix. Attach me that report after it is finished.



Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

• Click on the Scan button.
• After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Post logfile will also be saved in the C:\AdwCleaner folder.

Download TDSSKiller and save it to your desktop

Execute TDSSKiller.exe by doubleclicking on it.
Confirm "End user Licence Agreement" and "KSN Statement" dialog box by clicking on Accept button.

• Press Start Scan
• If Suspicious object is detected, the default action will be Skip, click on Continue.
• If Malicious objects are found, select Cure.

Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt


Please post the contents of that log in your next reply.

 

[Lalith Jayasinghe]

Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)

Open FRST, and click Fix. Attach me that report after it is finished.



Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

• Click on the Scan button.
• After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Post logfile will also be saved in the C:\AdwCleaner folder.

Download TDSSKiller and save it to your desktop

Execute TDSSKiller.exe by doubleclicking on it.
Confirm "End user Licence Agreement" and "KSN Statement" dialog box by clicking on Accept button.

• Press Start Scan
• If Suspicious object is detected, the default action will be Skip, click on Continue.
• If Malicious objects are found, select Cure.

Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt


Please post the contents of that log in your next reply.

Requested Files Attached.

 

[Lalith Jayasinghe]

@ TwinHeadedEagle
Ha Ha... Seems it worked. . now problem gone. There are no internet activity when idle. Thank you very much. Actually what was the problem. an Adware ?
Thank you very much. I really appreciate your guide all along with the case. Thank you.
It is well fitting the vision
malwaretips.com "Your Security Adviser".

 

[TwinHeadedEagle]

Glad that we solved this problem

Only thing left is to remove used tools:


Please download DelFix by "Xplode" to your Desktop.

Run the tool and check the following boxes below;

• Remove disinfection tools
• Create registry backup
• Purge System Restore

Now click on "Run" button. Wait for the programme completes his work.
All the tools we used should be gone.
Tool will create and open an log report (DelFix.txt)
Note: The report will also be stored on C:\DelFix.txt

> I don't need DelFix log report.

 

[Lalith Jayasinghe]

Glad that we solved this problem

Only thing left is to remove used tools:


Please download DelFix by "Xplode" to your Desktop.

Run the tool and check the following boxes below;

• Remove disinfection tools
• Create registry backup
• Purge System Restore

Now click on "Run" button. Wait for the programme completes his work.
All the tools we used should be gone.
Tool will create and open an log report (DelFix.txt)
Note: The report will also be stored on C:\DelFix.txt

> I don't need DelFix log report.

Done!. Thank you. Thank you. Thank you. .