I believe I am getting owned ...

[myusername]

part 1
I ran Ethereal to look at some unexplained and unexpected activity, and this capture.jpg was my result.

To my eye, it sure looks like an internal program has spontaneously decided that it needs to connect to 132.243.85.136

My understanding is that it has performed a DNS lookup of the address (which failed) and no actual connection attempt has taken place.

Concurrent with these lookups, I am manually blocking an outgoing connection attempt on port 139 with Kerio(so obviously that's not showing up in the packets).

Here's a kicker, though .. DNS requests on 3000 unique addresses, at an active rate of 70 requests per second!

edit: The requests are ###, but Kerio only picks up a couple of them trying to actually connect, and that seems to be one at a time and infrequent - haven't figured out what's up with that yet

Given the evidence, and assuming I have read this log properly, I can only assume that my computer is infected with something highly undesirable. Can anyone assess the soundness of that assumption for me?

If I am incorrect, there's no point reading beyond this line

part 2
Assuming the above, I would like to not only disinfect my system, but determine the source of the problem. Unfortunately, my running processes are all legit, and I have run the following software:

AVG
F-Secure AV
Kapersky AV
avast AV
adaware SE
spybot s&d
zero spyware
pest patrol
spysweeper
hijack this
tds-3

None of which have turned up *anything* suspicious or malicious.

At this point, I am severely tempted to back up my system, open up my firewall, and sniff packets for a couple minutes in the hope that the results will shed some new light on what is happening. Of course, since I don't know much about networking, this would probably be a futile effort

If anyone out there has any suggestions that sound more rational, I'd really appreciate hearing them

 

[cleverhandle]

Originally posted by: myusername
Concurrent with these lookups, I am manually blocking an outgoing connection attempt on port 139 with Kerio(so obviously that's not showing up in the packets).

That seems to be what all of this comes down to. The DNS stuff is probably just a side effect of that. I can't see how the DNS on it's own is terribly important - all you're seeing are a bunch of reverse lookups, and a virus wouldn't need a hostname in order to connect if it already has an IP address. So some other component of the system, maybe the firewall, is looking for hostnames to attach to the IP's. The outgoing attempts on port 139 are what you need to find the source of. Unfortunately, apart from making sure that your AV is up to date, I don't have any helpful advice for you there.

 

[myusername]

Originally posted by: cleverhandle
So some other component of the system, maybe the firewall, is looking for hostnames to attach to the IP's. The outgoing attempts on port 139 are what you need to find the source of.

Well SHOOT. I thought I had found something new, but you are correct - the DNS requests are coming from Kerio - it appears the log window dynamically resolves IP, so that big block of requests was probably not live attempts, but taken while I was scrolling one of the windows

 

[cleverhandle]

Originally posted by: myusername
...the DNS requests are coming from Kerio - it appears the log window dynamically resolves IP, so that big block of requests was probably not live attempts, but taken while I was scrolling one of the windows

Well, what I'd guess is that Kerio is detecting outbound connection attempts on port 139 to those IP's, and then tries to reverse lookup the IP's so that it can write the hostname to its log file. You can get similar effects just from running Ethereal (though it doesn't look like that's the case here) - by default, Ethereal will try to find hostnames for IP's, causing a lot of extra DNS traffic that tends to get in the way of what you're actually looking for. There's a toggle in Ethereal to turn off name resolution - there may be a similar kind of thing in Kerio as well.