Crazy amount of network connections, possible system compromise

Toggle sidebar Toggle sidebar
S

skeedo

Senior member
Nov 29, 2004
269
0
76
Running netstat -a, I have a lot of of connections which I believe to be loopback connections, and I'm not quite sure the reason for this.

Yesterday, I logged onto my bank website and it said it did not recognize my IP address and I had to provide answer to security question. Also, I placed an order for a Linux shell with a provider and they denied my order saying I sent by proxy. However, doing a lookup on my computer on various websites my IP resolves to a Verizon IP, and no proxy is detected...although I'm told you can be using a proxy that doesn't identify itself.

I have done scans with both Avast and Windows Defender that found nothing. I only download software from trusted sites and honestly have not had a virus since I moved to Windows 7 with Chrome some 8 months ago.

My bank website not recognizing my IP and shell provider claiming that I sent from a proxy is enough to raise suspicion however. Here are my netstat -a results after a fresh reboot, does anybody seen anything out of the ordinary here? I can't understand why I have all these open loopback connections, furthermore I don't like the established http and https connections that I see when I haven't even opened a web browser yet. I imagine there are other services that use http protocol other than web browser however, but just can't be completely sure that I'm out of the woods.


Code: 
Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    0.0.0.0:135            skeedo:0               LISTENING
  TCP    0.0.0.0:445            skeedo:0               LISTENING
  TCP    0.0.0.0:554            skeedo:0               LISTENING
  TCP    0.0.0.0:2869           skeedo:0               LISTENING
  TCP    0.0.0.0:3389           skeedo:0               LISTENING
  TCP    0.0.0.0:5357           skeedo:0               LISTENING
  TCP    0.0.0.0:10243          skeedo:0               LISTENING
  TCP    0.0.0.0:49152          skeedo:0               LISTENING
  TCP    0.0.0.0:49153          skeedo:0               LISTENING
  TCP    0.0.0.0:49155          skeedo:0               LISTENING
  TCP    0.0.0.0:49156          skeedo:0               LISTENING
  TCP    0.0.0.0:49157          skeedo:0               LISTENING
  TCP    0.0.0.0:49160          skeedo:0               LISTENING
  TCP    127.0.0.1:5354         skeedo:0               LISTENING
  TCP    127.0.0.1:12025        skeedo:0               LISTENING
  TCP    127.0.0.1:12080        skeedo:0               LISTENING
  TCP    127.0.0.1:12080        3dns:49178             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49190             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49192             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49195             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49197             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49198             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49199             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49200             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49201             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49202             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49203             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49211             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49212             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49215             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49216             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49217             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49223             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49225             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49227             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49229             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49230             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49233             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49235             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49236             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49239             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49240             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49241             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49249             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49251             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49253             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49255             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49256             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49257             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49258             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49259             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49265             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49267             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49269             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49271             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49273             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49274             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49281             ESTABLISHED
  TCP    127.0.0.1:12080        3dns:49283             ESTABLISHED
  TCP    127.0.0.1:12110        skeedo:0               LISTENING
  TCP    127.0.0.1:12119        skeedo:0               LISTENING
  TCP    127.0.0.1:12143        skeedo:0               LISTENING
  TCP    127.0.0.1:12465        skeedo:0               LISTENING
  TCP    127.0.0.1:12563        skeedo:0               LISTENING
  TCP    127.0.0.1:12993        skeedo:0               LISTENING
  TCP    127.0.0.1:12995        skeedo:0               LISTENING
  TCP    127.0.0.1:49178        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49190        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49192        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49195        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49197        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49198        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49199        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49200        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49201        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49202        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49203        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49211        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49212        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49215        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49216        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49217        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49223        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49225        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49227        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49229        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49230        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49233        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49235        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49236        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49239        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49240        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49241        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49249        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49251        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49253        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49255        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49256        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49257        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49258        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49259        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49265        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49267        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49269        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49271        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49273        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49274        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49281        3dns:12080             ESTABLISHED
  TCP    127.0.0.1:49283        3dns:12080             ESTABLISHED
  TCP    192.168.1.33:139       skeedo:0               LISTENING
  TCP    192.168.1.33:49181     vb-in-f104:https       ESTABLISHED
  TCP    192.168.1.33:49182     iad04s01-in-f95:https  TIME_WAIT
  TCP    192.168.1.33:49183     vb-in-f104:http        ESTABLISHED
  TCP    192.168.1.33:49185     vb-in-f104:https       TIME_WAIT
  TCP    192.168.1.33:49186     iad04s01-in-f113:https  ESTABLISHED
  TCP    192.168.1.33:49187     iad04s01-in-f120:https  TIME_WAIT
  TCP    192.168.1.33:49191     iad04s01-in-f100:http  ESTABLISHED
  TCP    192.168.1.33:49193     iad04s01-in-f138:http  ESTABLISHED
  TCP    192.168.1.33:49194     iad04s01-in-f120:https  ESTABLISHED
  TCP    192.168.1.33:49196     merlin:http            CLOSE_WAIT
  TCP    192.168.1.33:49204     72.21.81.253:http      CLOSE_WAIT
  TCP    192.168.1.33:49205     72.21.81.253:http      CLOSE_WAIT
  TCP    192.168.1.33:49206     72.21.81.253:http      CLOSE_WAIT
  TCP    192.168.1.33:49207     72.21.81.253:http      CLOSE_WAIT
  TCP    192.168.1.33:49208     72.21.81.253:http      CLOSE_WAIT
  TCP    192.168.1.33:49209     72.21.81.253:http      CLOSE_WAIT
  TCP    192.168.1.33:49210     advanced360:http       CLOSE_WAIT
  TCP    192.168.1.33:49213     a23-66-231-43:http     CLOSE_WAIT
  TCP    192.168.1.33:49214     a23-66-231-43:http     CLOSE_WAIT
  TCP    192.168.1.33:49218     iad04s01-in-f95:http   ESTABLISHED
  TCP    192.168.1.33:49219     iad04s01-in-f95:http   ESTABLISHED
  TCP    192.168.1.33:49220     iad04s01-in-f95:http   ESTABLISHED
  TCP    192.168.1.33:49224     www-slb-11-05-prn1:http  ESTABLISHED
  TCP    192.168.1.33:49226     72.21.81.253:http      CLOSE_WAIT
  TCP    192.168.1.33:49228     goku:http              ESTABLISHED
  TCP    192.168.1.33:49231     72.21.81.253:http      CLOSE_WAIT
  TCP    192.168.1.33:49232     72.21.81.253:http      CLOSE_WAIT
  TCP    192.168.1.33:49234     72.21.81.253:http      CLOSE_WAIT
  TCP    192.168.1.33:49237     72.21.81.253:http      CLOSE_WAIT
  TCP    192.168.1.33:49238     72.21.81.253:http      CLOSE_WAIT
  TCP    192.168.1.33:49243     merlin:http            CLOSE_WAIT
  TCP    192.168.1.33:49244     merlin:http            CLOSE_WAIT
  TCP    192.168.1.33:49245     merlin:http            CLOSE_WAIT
  TCP    192.168.1.33:49250     iad04s01-in-f113:http  ESTABLISHED
  TCP    192.168.1.33:49252     64.152.208.202:http    ESTABLISHED
  TCP    192.168.1.33:49254     a72-247-242-72:http    CLOSE_WAIT
  TCP    192.168.1.33:49260     a72-247-242-72:http    CLOSE_WAIT
  TCP    192.168.1.33:49261     a72-247-242-72:http    CLOSE_WAIT
  TCP    192.168.1.33:49262     a72-247-242-72:http    CLOSE_WAIT
  TCP    192.168.1.33:49263     a72-247-242-72:http    CLOSE_WAIT
  TCP    192.168.1.33:49264     a72-247-242-72:http    CLOSE_WAIT
  TCP    192.168.1.33:49266     a23-66-231-57:http     ESTABLISHED
  TCP    192.168.1.33:49268     208-44-23-96:http      ESTABLISHED
  TCP    192.168.1.33:49270     goku:http              ESTABLISHED
  TCP    192.168.1.33:49272     cdn-208-111-161-254:http  CLOSE_WAIT
  TCP    192.168.1.33:49275     cdn-208-111-161-254:http  CLOSE_WAIT
  TCP    192.168.1.33:49276     cdn-208-111-161-254:http  CLOSE_WAIT
  TCP    192.168.1.33:49282     67.148.147.80:http     ESTABLISHED
  TCP    192.168.1.33:49284     67.148.147.80:http     ESTABLISHED
  TCP    [::]:135               skeedo:0               LISTENING
  TCP    [::]:445               skeedo:0               LISTENING
  TCP    [::]:554               skeedo:0               LISTENING
  TCP    [::]:2869              skeedo:0               LISTENING
  TCP    [::]:3389              skeedo:0               LISTENING
  TCP    [::]:3587              skeedo:0               LISTENING
  TCP    [::]:5357              skeedo:0               LISTENING
  TCP    [::]:10243             skeedo:0               LISTENING
  TCP    [::]:49152             skeedo:0               LISTENING
  TCP    [::]:49153             skeedo:0               LISTENING
  TCP    [::]:49155             skeedo:0               LISTENING
  TCP    [::]:49156             skeedo:0               LISTENING
  TCP    [::]:49157             skeedo:0               LISTENING
  TCP    [::]:49160             skeedo:0               LISTENING
  UDP    0.0.0.0:3544           *:*                    
  UDP    0.0.0.0:3702           *:*                    
  UDP    0.0.0.0:3702           *:*                    
  UDP    0.0.0.0:3702           *:*                    
  UDP    0.0.0.0:3702           *:*                    
  UDP    0.0.0.0:5004           *:*                    
  UDP    0.0.0.0:5005           *:*                    
  UDP    0.0.0.0:5355           *:*                    
  UDP    0.0.0.0:54818          *:*                    
  UDP    0.0.0.0:54820          *:*                    
  UDP    0.0.0.0:56882          *:*                    
  UDP    0.0.0.0:57313          *:*                    
  UDP    127.0.0.1:1900         *:*                    
  UDP    127.0.0.1:44301        *:*                    
  UDP    127.0.0.1:45301        *:*                    
  UDP    127.0.0.1:56881        *:*                    
  UDP    127.0.0.1:56887        *:*                    
  UDP    192.168.1.33:137       *:*                    
  UDP    192.168.1.33:138       *:*                    
  UDP    192.168.1.33:1900      *:*                    
  UDP    192.168.1.33:5353      *:*                    
  UDP    192.168.1.33:56886     *:*                    
  UDP    192.168.1.33:64784     *:*                    
  UDP    [::]:3540              *:*                    
  UDP    [::]:3702              *:*                    
  UDP    [::]:3702              *:*                    
  UDP    [::]:3702              *:*                    
  UDP    [::]:3702              *:*                    
  UDP    [::]:5004              *:*                    
  UDP    [::]:5005              *:*                    
  UDP    [::]:5355              *:*                    
  UDP    [::]:54819             *:*                    
  UDP    [::]:54821             *:*                    
  UDP    [::]:56883             *:*                    
  UDP    [::]:57314             *:*                    
  UDP    [::1]:1900             *:*                    
  UDP    [::1]:56885            *:*                    
  UDP    [fe80::58cc:59d9:a4f6:f96a%10]:546  *:*                    
  UDP    [fe80::58cc:59d9:a4f6:f96a%10]:1900  *:*                    
  UDP    [fe80::58cc:59d9:a4f6:f96a%10]:56884  *:*
 
AFurryReptile

AFurryReptile

Golden Member
Nov 5, 2006
1,998
1
76
That's completely normal, don't sweat it. Exactly 0 of those IP's are even internet routable.
 
P

power_hour

Senior member
Oct 16, 2010
779
1
0
Install Wireshark and view the results. Windows 7 is a bit chatty tho so don't freak out yet. And what exactly do you mean your bank doesn't recognize your IP? That could mean someone is attempting to access your accounts from another PC. Take steps to verify what they are saying immediately.
 
S

SecurityTheatre

Senior member
Aug 14, 2011
672
0
0
It looks like a computer that has visited a few different web pages in the last 20 minutes.


Was that you?

If so, totally normal.

Windows is massive, bloated, chatty on the network and all of those little updaters, agents, plugins, etc... each want to visit a site.

Flash is checking for updates, Java is checking for updates. iTunes is checking for updates, the browser is getting pages, antivirus is checking pages for malware and spam, email services are checking email.

Most of that happens without even opening other programs. :)

And the overweight reptile is correct, none of the IPv4 addresses in there are routeable, it's all outbound connections.

Actually, if you're paranoid, maybe go disable IPv6. Under the network settings for your Local Area connection, simply uncheck the box. That's the only potentially routeable address you have.

It's possible your IP changed recently on your ISP. That IP could have been long ago listed in a SPAM database and you ran into that. Your bank would also not recognize your IP and might ask for confirmation. Many ISPs change your external IP on a daily/weekly/monthly basis, some do it less often.

Doesn't seem critical to me, though any of us can certainly be wrong or have overlooked something
 
Last edited:
S

skeedo

Senior member
Nov 29, 2004
269
0
76
Welp, looks like my IP address has been changing, I thought it would be more static since I am never offline. Looking at some IRC logs I'm seeing that it is different today than it was yesterday so it must change quite frequently. You'd think that my Bank website wouldn't freak out when I'm coming from different IP but from same subnet, but I guess its just a security precaution. I also logon my bank website from my work which is a static IP so that may have been throwing it off as well.

I downloaded Wireshark to capture packets. I have used it before, but far in the past for a college project and didn't really learn much about it then. I may or may not be reading this right, but I am seeing one thing that seems suspicious:

Code: 
796	99.509054	192.168.1.33	78.46.145.99	TCP	73	49485 > 20069 [PSH, ACK] Seq=1 Ack=1 Win=16327 Len=19
798	99.836215	192.168.1.33	78.46.145.99	TCP	54	49485 > 20069 [ACK] Seq=20 Ack=50 Win=16314 Len=0

20069 is my Bittorrent port, one of the few ports that I have open. If I am right, it keeps sending the same length packet to that same IP address through the Bittorrent port. This doesn't seem to occur too often, but it does. Thing is, I do not have a bittorrent client open and I am still sending packets to this IP address.

Is this suspect? Is there anything specific I should be looking for that would indicate an intrusion?
 
S

skeedo

Senior member
Nov 29, 2004
269
0
76
Actually, nevermind about that, the paranoia is really getting to me heh. The port I use to connect to my psybnc is also 20069, so I wasn't reading it right. I knew it was my IRC client after analyzing actual packet data that was sent.

Can anybody give me some pointers on how to identify intrusions, specifically what kind of packets I should be looking for? Thanks.
 
P

power_hour

Senior member
Oct 16, 2010
779
1
0
skeedo said:
Actually, nevermind about that, the paranoia is really getting to me heh. The port I use to connect to my psybnc is also 20069, so I wasn't reading it right. I knew it was my IRC client after analyzing actual packet data that was sent.

Can anybody give me some pointers on how to identify intrusions, specifically what kind of packets I should be looking for? Thanks.
Click to expand...

Your on the right track. Wireshark has an amazing number of tutorials. Also search Youtube and Google for more tips.

However at this stage of the game, I would format and reinstall the OS. These days thats what 30-45min tops? Then you install VirtualBox and create a couple of VMs. One for banking and one for browsing and never mix them. Recycle them every 30 days.

Cheers,
 
S

smxfx

Junior Member
Apr 16, 2015
1
0
0
:eek: Please tell me where I can find this mystical beast? Why...the 30 - 45 minute install that is! I'll think I died and went to Heaven! :)
Ps: This is my first post on this forum. Hey...ya gotta start somewhere. :cool:
 
You must log in or register to reply here.

TRENDING THREADS

COMPANY
RESOURCES
FOLLOW
Top Bottom