Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Need help securing my home network.


  • Please log in to reply
6 replies to this topic

#1 Swift44

Swift44

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:20 PM

Posted 14 December 2017 - 08:19 PM

This is attempt number 2 to post my logs here as my browser keeps crashing. Long story short, malware infected all the computers and now I'm not really sure how to tackle the issue. Already posted my FRST log on the Malware forum so I figured I would get some advice here. Any help is much appreciated.

 

Computer: Dell Inspiron 15 7000 Gaming Laptop

 

Computer Connection: Mostly Wired (sometimes wireless)

 

Router Make and Model: DIR-859 w/ latest DD-WRT firmware

 

Approximate distance: < 20 feet

 

Type of Internet Connection: DSL

 

MiniToolBox by Farbar  Version: 17-06-2016
Ran by Dan (administrator) on 14-12-2017 at 16:43:31
Running from "C:\Users\Dan\Desktop"
Microsoft Windows 10 Home  (X64)
Model: Inspiron 15 7000 Gaming Manufacturer: Dell Inc.
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================


"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================
127.0.0.1       localhost0.0.0.0    choice.microsoft.com
0.0.0.0    choice.microsoft.com.nstac.net
0.0.0.0    df.telemetry.microsoft.com
0.0.0.0    oca.telemetry.microsoft.com
0.0.0.0    oca.telemetry.microsoft.com.nsatc.net
0.0.0.0    redir.metaservices.microsoft.com
0.0.0.0    reports.wes.df.telemetry.microsoft.com
0.0.0.0    services.wes.df.telemetry.microsoft.com
0.0.0.0    settings-sandbox.data.microsoft.com
0.0.0.0    settings-win.data.microsoft.com
0.0.0.0    sqm.df.telemetry.microsoft.com
0.0.0.0    sqm.telemetry.microsoft.com
0.0.0.0    sqm.telemetry.microsoft.com.nsatc.net
0.0.0.0    telecommand.telemetry.microsoft.com
0.0.0.0    telecommand.telemetry.microsoft.com.nsatc.net
0.0.0.0    telemetry.appex.bing.net
0.0.0.0    telemetry.microsoft.com
0.0.0.0    telemetry.urs.microsoft.com
0.0.0.0    vortex-sandbox.data.microsoft.com
0.0.0.0    vortex-win.data.microsoft.com
0.0.0.0    vortex.data.microsoft.com
0.0.0.0    watson.telemetry.microsoft.com
0.0.0.0    watson.telemetry.microsoft.com.nsatc.net
0.0.0.0    watson.ppe.telemetry.microsoft.com
0.0.0.0    wes.df.telemetry.microsoft.com
0.0.0.0    vortex-bn2.metron.live.com.nsatc.net
0.0.0.0    vortex-cy2.metron.live.com.nsatc.net
0.0.0.0    watson.live.com
0.0.0.0    watson.microsoft.com
0.0.0.0    feedback.search.microsoft.com

There are 11 entries.

========================= IP Configuration: ================================

Realtek PCIe GBE Family Controller = Ethernet (Connected)
Microsoft KM-TEST Loopback Adapter = Npcap Loopback Adapter (Connected)
Intel® Dual Band Wireless-AC 3165 = Wi-Fi (Media disconnected)
Bluetooth Device (Personal Area Network) = Bluetooth Network Connection (Media disconnected)


# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global defaultcurhoplimit=64
add route prefix=204.79.197.200/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=23.218.212.69/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=204.160.124.125/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=8.253.14.126/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=8.254.25.126/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=93.184.215.200/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=198.78.194.252/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=198.78.209.253/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=8.254.23.254/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=131.253.14.76/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=23.201.58.73/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=191.236.16.12/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=157.56.91.82/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=23.61.72.70/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.52.100.7/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=207.46.202.114/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.55.252.63/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.52.100.91/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=104.79.156.195/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.52.100.92/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.55.44.108/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=157.56.106.210/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=168.62.11.145/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=23.96.212.225/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.52.100.94/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.55.252.93/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=134.170.115.60/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=207.46.114.61/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.52.108.153/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=64.4.54.22/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.55.252.92/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=168.62.187.13/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.52.100.9/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=131.253.40.37/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=64.4.54.254/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=64.4.54.32/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=207.46.223.94/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.55.252.71/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.52.100.11/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.52.108.29/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
add route prefix=65.52.100.93/32 interface="iftype0_0" nexthop=0.0.0.0 metric=1 publish=Yes
set interface interface="Ethernet" forwarding=disabled advertise=disabled metric=0 siteprefixlength=0 nud=disabled routerdiscovery=disabled managedaddress=disabled otherstateful=disabled weakhostsend=disabled weakhostreceive=disabled ignoredefaultroutes=disabled advertisedrouterlifetime=0 advertisedefaultroute=disabled currenthoplimit=0 forcearpndwolpattern=disabled enabledirectedmacwolpattern=disabled ecncapability=ecndisabled rabaseddnsconfig=disabled dhcpstaticipcoexistence=disabled
set interface interface="Bluetooth Network Connection" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Npcap Loopback Adapter" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Local Area Connection* 12" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set subinterface interface=??????? subinterface=ethernet_32769 mtu=1492


popd
# End of IPv4 configuration



Windows IP Configuration

   Host Name . . . . . . . . . . . . : DESKTOP-DL9O2RK
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
   Physical Address. . . . . . . . . : 64-00-6A-FD-D4-F2
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.9.101(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Thursday, December 14, 2017 1:57:52 PM
   Lease Expires . . . . . . . . . . : Friday, December 15, 2017 1:57:52 PM
   Default Gateway . . . . . . . . . : 192.168.9.37
   DHCP Server . . . . . . . . . . . : 192.168.9.37
   DNS Servers . . . . . . . . . . . : 192.168.9.37
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Npcap Loopback Adapter:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Npcap Loopback Adapter
   Physical Address. . . . . . . . . : 02-00-4C-4F-4F-50
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::d05c:ae3a:94f:1d18%8(Preferred)
   Autoconfiguration IPv4 Address. . : 169.254.29.24(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 587333708
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-BD-0B-29-64-00-6A-FD-D4-F2
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Wi-Fi:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel® Dual Band Wireless-AC 3165
   Physical Address. . . . . . . . . : 7C-67-A2-21-E0-BC
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 10:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
   Physical Address. . . . . . . . . : 7C-67-A2-21-E0-BD
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Bluetooth Network Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
   Physical Address. . . . . . . . . : 7C-67-A2-21-E0-C0
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:953c:1866:3fab:3f57:f69a(Preferred)
   Link-local IPv6 Address . . . . . : fe80::1866:3fab:3f57:f69a%4(Preferred)
   Default Gateway . . . . . . . . . : ::
   DHCPv6 IAID . . . . . . . . . . . : 134217728
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-BD-0B-29-64-00-6A-FD-D4-F2
   NetBIOS over Tcpip. . . . . . . . : Disabled
Server:  DD-WRT
Address:  192.168.9.37

Name:    google.com
Addresses:  2607:f8b0:400a:808::200e
      172.217.3.174


Pinging google.com [172.217.3.174] with 32 bytes of data:
Reply from 172.217.3.174: bytes=32 time=17ms TTL=56
Reply from 172.217.3.174: bytes=32 time=18ms TTL=56

Ping statistics for 172.217.3.174:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 17ms, Maximum = 18ms, Average = 17ms
Server:  DD-WRT
Address:  192.168.9.37

Name:    yahoo.com
Addresses:  2001:4998:44:204::100d
      2001:4998:c:e33::53
      2001:4998:58:2201::73
      98.139.180.180
      206.190.39.42
      98.138.252.38


Pinging yahoo.com [98.138.252.38] with 32 bytes of data:
Reply from 98.138.252.38: bytes=32 time=85ms TTL=53
Reply from 98.138.252.38: bytes=32 time=80ms TTL=53

Ping statistics for 98.138.252.38:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 80ms, Maximum = 85ms, Average = 82ms

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=64
Reply from 127.0.0.1: bytes=32 time<1ms TTL=64

Ping statistics for 127.0.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
  3...64 00 6a fd d4 f2 ......Realtek PCIe GBE Family Controller
  8...02 00 4c 4f 4f 50 ......Npcap Loopback Adapter
  6...7c 67 a2 21 e0 bc ......Intel® Dual Band Wireless-AC 3165
  7...7c 67 a2 21 e0 bd ......Microsoft Wi-Fi Direct Virtual Adapter
 11...7c 67 a2 21 e0 c0 ......Bluetooth Device (Personal Area Network)
  1...........................Software Loopback Interface 1
  4...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.9.37    192.168.9.101     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      169.254.0.0      255.255.0.0         On-link     169.254.29.24    281
    169.254.29.24  255.255.255.255         On-link     169.254.29.24    281
  169.254.255.255  255.255.255.255         On-link     169.254.29.24    281
      192.168.9.0    255.255.255.0         On-link     192.168.9.101    281
    192.168.9.101  255.255.255.255         On-link     192.168.9.101    281
    192.168.9.255  255.255.255.255         On-link     192.168.9.101    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
        224.0.0.0        240.0.0.0         On-link     169.254.29.24    281
        224.0.0.0        240.0.0.0         On-link     192.168.9.101    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
  255.255.255.255  255.255.255.255         On-link     169.254.29.24    281
  255.255.255.255  255.255.255.255         On-link     192.168.9.101    281
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
   204.79.197.200  255.255.255.255         On-link        1
    23.218.212.69  255.255.255.255         On-link        1
  204.160.124.125  255.255.255.255         On-link        1
     8.253.14.126  255.255.255.255         On-link        1
     8.254.25.126  255.255.255.255         On-link        1
   93.184.215.200  255.255.255.255         On-link        1
   198.78.194.252  255.255.255.255         On-link        1
   198.78.209.253  255.255.255.255         On-link        1
     8.254.23.254  255.255.255.255         On-link        1
    131.253.14.76  255.255.255.255         On-link        1
     23.201.58.73  255.255.255.255         On-link        1
    191.236.16.12  255.255.255.255         On-link        1
     157.56.91.82  255.255.255.255         On-link        1
      23.61.72.70  255.255.255.255         On-link        1
      65.52.100.7  255.255.255.255         On-link        1
   207.46.202.114  255.255.255.255         On-link        1
     65.55.252.63  255.255.255.255         On-link        1
     65.52.100.91  255.255.255.255         On-link        1
   104.79.156.195  255.255.255.255         On-link        1
     65.52.100.92  255.255.255.255         On-link        1
     65.55.44.108  255.255.255.255         On-link        1
   157.56.106.210  255.255.255.255         On-link        1
    168.62.11.145  255.255.255.255         On-link        1
    23.96.212.225  255.255.255.255         On-link        1
     65.52.100.94  255.255.255.255         On-link        1
     65.55.252.93  255.255.255.255         On-link        1
   134.170.115.60  255.255.255.255         On-link        1
    207.46.114.61  255.255.255.255         On-link        1
    65.52.108.153  255.255.255.255         On-link        1
       64.4.54.22  255.255.255.255         On-link        1
     65.55.252.92  255.255.255.255         On-link        1
    168.62.187.13  255.255.255.255         On-link        1
      65.52.100.9  255.255.255.255         On-link        1
    131.253.40.37  255.255.255.255         On-link        1
      64.4.54.254  255.255.255.255         On-link        1
       64.4.54.32  255.255.255.255         On-link        1
    207.46.223.94  255.255.255.255         On-link        1
     65.55.252.71  255.255.255.255         On-link        1
     65.52.100.11  255.255.255.255         On-link        1
     65.52.108.29  255.255.255.255         On-link        1
     65.52.100.93  255.255.255.255         On-link        1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  4    331 ::/0                     On-link
  1    331 ::1/128                  On-link
  4    331 2001::/32                On-link
  4    331 2001:0:9d38:953c:1866:3fab:3f57:f69a/128
                                    On-link
  8    281 fe80::/64                On-link
  4    331 fe80::/64                On-link
  4    331 fe80::1866:3fab:3f57:f69a/128
                                    On-link
  8    281 fe80::d05c:ae3a:94f:1d18/128
                                    On-link
  1    331 ff00::/8                 On-link
  8    281 ff00::/8                 On-link
  4    331 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None
========================= Winsock entries =====================================

Catalog5 01 C:\WINDOWS\SysWOW64\napinsp.dll [54784] (Microsoft Corporation)
Catalog5 02 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70656] (Microsoft Corporation)
Catalog5 03 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70656] (Microsoft Corporation)
Catalog5 04 C:\WINDOWS\SysWOW64\NLAapi.dll [63488] (Microsoft Corporation)
Catalog5 05 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog5 06 C:\WINDOWS\SysWOW64\winrnr.dll [24064] (Microsoft Corporation)
Catalog5 07 C:\WINDOWS\SysWOW64\wshbth.dll [50688] (Microsoft Corporation)
Catalog9 01 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 02 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 03 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 04 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 05 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 06 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 07 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 08 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 09 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 10 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 11 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
Catalog9 12 C:\WINDOWS\SysWOW64\mswsock.dll [334744] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\napinsp.dll [67072] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\pnrpnsp.dll [84992] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [84992] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\NLAapi.dll [79872] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [31232] (Microsoft Corporation)
x64-Catalog5 07 C:\Windows\System32\wshbth.dll [63488] (Microsoft Corporation)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 11 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)
x64-Catalog9 12 C:\Windows\System32\mswsock.dll [402992] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (12/14/2017 04:28:25 PM) (Source: Application Error) (User: )
Description: Faulting application name: seccenter.exe, version: 22.0.17.205, time stamp: 0x5a2ea1ca
Faulting module name: sciter.dll, version: 4.0.0.7, time stamp: 0x599c0c16
Exception code: 0xc0000005
Fault offset: 0x000000000018d8fb
Faulting process id: 0x117c
Faulting application start time: 0xseccenter.exe0
Faulting application path: seccenter.exe1
Faulting module path: seccenter.exe2
Report Id: seccenter.exe3
Faulting package full name: seccenter.exe4
Faulting package-relative application ID: seccenter.exe5

Error: (12/14/2017 03:11:14 PM) (Source: Application Error) (User: )
Description: Faulting application name: seccenter.exe, version: 22.0.17.205, time stamp: 0x5a2ea1ca
Faulting module name: sciter.dll, version: 4.0.0.7, time stamp: 0x599c0c16
Exception code: 0xc0000005
Fault offset: 0x000000000018d8fb
Faulting process id: 0x22f4
Faulting application start time: 0xseccenter.exe0
Faulting application path: seccenter.exe1
Faulting module path: seccenter.exe2
Report Id: seccenter.exe3
Faulting package full name: seccenter.exe4
Faulting package-relative application ID: seccenter.exe5

Error: (12/14/2017 01:58:02 PM) (Source: ESENT) (User: )
Description: taskhostw (6344,U,0) WebCacheLocal: Database recovery/restore failed with unexpected error -1216.

Error: (12/14/2017 01:58:02 PM) (Source: ESENT) (User: )
Description: taskhostw (6344,U,0) WebCacheLocal: Database recovery failed with error -1216 because it encountered references to a database, 'C:\Users\Dan\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat', which is no longer present. The database was not brought to a Clean Shutdown state before it was removed (or possibly moved or renamed). The database engine will not permit recovery to complete for this instance until the missing database is re-instated. If the database is truly no longer available and no longer required, procedures for recovering from this error are available in the Microsoft Knowledge Base or by following the "more information" link at the bottom of this message.

Error: (12/14/2017 11:32:57 AM) (Source: Application Error) (User: )
Description: Faulting application name: seccenter.exe, version: 22.0.17.205, time stamp: 0x5a2ea1ca
Faulting module name: sciter.dll, version: 4.0.0.7, time stamp: 0x599c0c16
Exception code: 0xc0000005
Fault offset: 0x000000000018d8fb
Faulting process id: 0x2dec
Faulting application start time: 0xseccenter.exe0
Faulting application path: seccenter.exe1
Faulting module path: seccenter.exe2
Report Id: seccenter.exe3
Faulting package full name: seccenter.exe4
Faulting package-relative application ID: seccenter.exe5

Error: (12/14/2017 03:59:18 AM) (Source: System Restore) (User: )
Description: Failed to create restore point (Process = C:\WINDOWS\system32\wbem\wmiprvse.exe; Description = TRON v10.4.2: Post-run checkpoint; Error = 0x8007043c).

Error: (12/14/2017 03:57:02 AM) (Source: MsiInstaller) (User: DESKTOP-DL9O2RK)
Description: Product: Adobe Flash Player 27 ActiveX -- Your Microsoft Internet Explorer browser includes the latest version of the Adobe Flash Player built-in. Windows Update will inform you when new versions of the Flash Player are available.

Error: (12/14/2017 03:56:56 AM) (Source: System Restore) (User: )
Description: Failed to create restore point (Process = C:\WINDOWS\system32\wbem\wmiprvse.exe; Description = O&O ShutUp10; Error = 0x8007043c).


System errors:
=============
Error: (12/14/2017 02:12:56 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

Error: (12/14/2017 01:59:55 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: {C41B1461-3F8C-4666-B512-6DF24DE566D1}

Error: (12/14/2017 01:58:46 PM) (Source: Application Popup) (User: )
Description: \SystemRoot\System32\DRIVERS\PSKMAD.sys

Error: (12/14/2017 01:57:57 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalActivation{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

Error: (12/14/2017 01:57:57 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalActivation{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

Error: (12/14/2017 01:57:53 PM) (Source: Application Popup) (User: )
Description: \SystemRoot\System32\DRIVERS\PSKMAD.sys

Error: (12/14/2017 01:45:15 PM) (Source: Application Popup) (User: )
Description: \SystemRoot\System32\DRIVERS\PSKMAD.sys

Error: (12/14/2017 11:26:35 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

Error: (12/14/2017 11:18:33 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

Error: (12/14/2017 11:13:33 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: {C41B1461-3F8C-4666-B512-6DF24DE566D1}


Microsoft Office Sessions:
=========================
Error: (12/14/2017 04:28:25 PM) (Source: Application Error)(User: )
Description: seccenter.exe22.0.17.2055a2ea1casciter.dll4.0.0.7599c0c16c0000005000000000018d8fb117c01d3753b8c0696c2C:\Program Files\Bitdefender\Bitdefender Security\seccenter.exeC:\Program Files\Bitdefender\Bitdefender Security\sciter.dll9d3f8ef1-9929-4efc-ab43-58ad658e7d3c

Error: (12/14/2017 03:11:14 PM) (Source: Application Error)(User: )
Description: seccenter.exe22.0.17.2055a2ea1casciter.dll4.0.0.7599c0c16c0000005000000000018d8fb22f401d3752f9f2c4e80C:\Program Files\Bitdefender\Bitdefender Security\seccenter.exeC:\Program Files\Bitdefender\Bitdefender Security\sciter.dll5e5cc24c-2001-49ef-9a80-ecb36f408fe6

Error: (12/14/2017 01:58:02 PM) (Source: ESENT)(User: )
Description: taskhostw6344,U,0WebCacheLocal: -1216

Error: (12/14/2017 01:58:02 PM) (Source: ESENT)(User: )
Description: taskhostw6344,U,0WebCacheLocal: -1216C:\Users\Dan\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

Error: (12/14/2017 11:32:57 AM) (Source: Application Error)(User: )
Description: seccenter.exe22.0.17.2055a2ea1casciter.dll4.0.0.7599c0c16c0000005000000000018d8fb2dec01d3750f7c895a60C:\Program Files\Bitdefender\Bitdefender Security\seccenter.exeC:\Program Files\Bitdefender\Bitdefender Security\sciter.dll4144dd0f-43bb-4c51-9a2f-1629f9882050

Error: (12/14/2017 03:59:18 AM) (Source: System Restore)(User: )
Description: C:\WINDOWS\system32\wbem\wmiprvse.exeTRON v10.4.2: Post-run checkpoint0x8007043c

Error: (12/14/2017 03:57:02 AM) (Source: MsiInstaller)(User: DESKTOP-DL9O2RK)
Description: Product: Adobe Flash Player 27 ActiveX -- Your Microsoft Internet Explorer browser includes the latest version of the Adobe Flash Player built-in. Windows Update will inform you when new versions of the Flash Player are available.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (12/14/2017 03:56:56 AM) (Source: System Restore)(User: )
Description: C:\WINDOWS\system32\wbem\wmiprvse.exeO&O ShutUp100x8007043c


CodeIntegrity Errors:
===================================
  Date: 2017-12-14 13:57:54.851
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Bitdefender\Bitdefender Security\vsservp.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bitdefender\Bitdefender Security\dbghelp.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-12-14 11:11:33.004
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Bitdefender\Bitdefender Security\vsservp.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bitdefender\Bitdefender Security\dbghelp.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-12-13 23:10:00.242
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Bitdefender\Bitdefender Security\vsservp.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bitdefender\Bitdefender Security\dbghelp.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-12-13 22:43:44.882
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

  Date: 2017-12-13 22:43:41.400
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

  Date: 2017-12-13 22:42:16.313
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

  Date: 2017-12-13 22:42:15.677
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

  Date: 2017-12-13 22:41:51.144
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

  Date: 2017-12-13 22:41:41.989
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.

  Date: 2017-12-13 22:41:41.850
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.


=========================== Installed Programs ============================

Bitdefender Agent (HKLM\...\Bitdefender Agent) (Version: 22.0.10.67 - Bitdefender)
Bitdefender Device Management (HKLM\...\Bitdefender Device Management) (Version: 22.0.15.189 - Bitdefender)
Bitdefender Home Scanner (HKLM\...\Bitdefender Home Scanner) (Version: 1.0.2.266 - Bitdefender)
Bitdefender Total Security (HKLM\...\Bitdefender) (Version: 22.0.17.205 - Bitdefender)
CCleaner (HKLM\...\CCleaner) (Version: 5.38 - Piriform)
Complete Internet Repair 5.0.1.3812 (HKLM\...\Complete Internet Repair_is1) (Version: 5.0.1.3812 - Rizonesoft)
DiskBoss 8.7.14 (HKLM-x32\...\DiskBoss) (Version: 8.7.14 - Flexense Computing Systems Ltd.)
Everything 1.4.1.877 (x64) (HKLM\...\Everything) (Version: 1.4.1.877 (x64) - David Carpenter)
Firewall Builder 5.1 (HKLM-x32\...\FWBuilder 5.1) (Version: 5.1.0.3599 - NetCitadel LLC)
Hacknet (HKLM\...\Steam App 365450) (Version:  - Team Fractal Alligator)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 22.20.16.4836 - Intel Corporation)
Malwarebytes version 3.3.1.2183 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Mozilla Firefox 57.0.2 (x64 en-US) (HKLM\...\Mozilla Firefox 57.0.2 (x64 en-US)) (Version: 57.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 57.0.2 - Mozilla)
Network Inventory Advisor 5.0.106 (HKLM-x32\...\{C8C59D9B-F7F8-454E-9DA0-CB4D9F1895DD}_is1) (Version: 5.0.106 - Copyright © 1999-2015 by ClearApps)
Npcap 0.92 (HKLM-x32\...\NpcapInst) (Version: 0.92 - Nmap Project)
Panda Cloud Cleaner (HKLM-x32\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.1.10 - Panda Security)
PuTTY release 0.70 (64-bit) (HKLM\...\{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}) (Version: 0.70.0.0 - Simon Tatham)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8308 - Realtek Semiconductor Corp.)
Revo Uninstaller 2.0.4 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.4 - VS Revo Group, Ltd.)
RoboForm 8-4-3-4 (All Users) (HKLM-x32\...\AI RoboForm) (Version: 8-4-3-4 - Siber Systems)
Rocket League (HKLM\...\Steam App 252950) (Version:  - Psyonix, Inc.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1250 - SUPERAntiSpyware.com)
The Dude (HKLM-x32\...\Dude) (Version:  - )
Tweaking.com - Windows Repair (HKLM-x32\...\Tweaking.com - Windows Repair) (Version: 4.0.10 - Tweaking.com)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{DE083343-D24D-4495-919E-18C65EC0F289}) (Version: 2.8.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM-x32\...\{B7AFAF92-D1C8-49A0-B34A-B5DAF9C9D5C6}) (Version: 1.9.0.0 - Microsoft Corporation) Hidden
USBPcap 1.2.0.3 (HKLM\...\USBPcap) (Version: 1.2.0.3 - Tomasz Mon)
Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0) (Version: 1.0.33.0 - LunarG, Inc.) Hidden
Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0-3) (Version: 1.0.33.0 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.54.1 (HKLM\...\VulkanRT1.0.54.1) (Version: 1.0.54.1 - Intel Corporation Inc.)
Vulkan Run Time Libraries 1.0.61.0 (HKLM\...\VulkanRT1.0.61.0) (Version: 1.0.61.0 - LunarG, Inc.) Hidden
Windows 10 Update Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.22314 - Microsoft Corporation)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
Wireshark 2.4.3 64-bit (HKLM-x32\...\Wireshark) (Version: 2.4.3 - The Wireshark developer community, https://www.wireshark.org)

========================= Devices: ================================


========================= Memory info: ===================================

Percentage of memory in use: 59%
Total physical RAM: 8058.46 MB
Available physical RAM: 3294.58 MB
Total Virtual: 9338.46 MB
Available Virtual: 3834.05 MB

========================= Partitions: =====================================

1 Drive c: () (Fixed) (Total:236.6 GB) (Free:181.17 GB) NTFS

========================= Users: ========================================

User accounts for \\DESKTOP-DL9O2RK

Administrator            Dan                      DefaultAccount           
Guest                    WDAGUtilityAccount       

========================= Minidump Files ==================================

No minidump file found

========================= Restore Points ==================================

14-12-2017 02:31:16 Revo Uninstaller's restore point - Complete Internet Repair 5.0.1.3812
14-12-2017 02:32:07 Revo Uninstaller's restore point - COMODO Firewall
14-12-2017 02:32:51 Revo Uninstaller's restore point - COMODO Firewall
14-12-2017 02:33:52 Removing COMODO Client - Security
14-12-2017 05:07:22 Revo Uninstaller's restore point - Internet Security Essentials
14-12-2017 05:08:33 Revo Uninstaller's restore point - Comodo Dragon
14-12-2017 06:10:19 Revo Uninstaller's restore point - Malwarebytes version 3.3.1.2183
14-12-2017 06:23:26 Revo Uninstaller's restore point - Google Chrome
14-12-2017 06:24:31 Revo Uninstaller's restore point - Microsoft OneDrive
14-12-2017 06:25:59 Revo Uninstaller's restore point - Mozilla Firefox 57.0.2 (x64 en-US)

**** End of log ****
 



BC AdBot (Login to Remove)

 


#2 Replicator

Replicator

  • Members
  • 306 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Dark Basement
  • Local time:07:20 AM

Posted 15 December 2017 - 10:32 AM

 Long story short, malware infected all the computers and now I'm not really sure how to tackle the issue. Already posted my FRST log on the Malware forum

 

Hi Swift, long story short, you need a clean bill of health first from the malware experts here before we can help with doing anything else, otherwise we may be just running around in circles.

 

Stick with the malware forum for now and follow their instructions till its done.

 

Once they give you the ok, then we can look at your other network issues.

 

Cheers


Edited by Replicator, 15 December 2017 - 10:33 AM.

The quieter you become, the more you are able to hear!
CEH, CISSP @ WhiteHat Computers Pty Ltd

 


#3 Swift44

Swift44
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:20 PM

Posted 15 December 2017 - 11:23 AM

Hi, sorry for the confusion. I should have mentioned they gave me the all clear on the malware forum and directed me here for further assistance.

#4 Swift44

Swift44
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:20 PM

Posted 15 December 2017 - 12:45 PM

I should also mention I'm normally a DIYer when it comes to computer issues but my knowledge of advanced networking jargon is limited. Ie teredo/Isatap tunneling, etc. So it's a little alarming to me to see these interfaces show up in ipconfig on a clean windows install and a brand new router.

#5 Replicator

Replicator

  • Members
  • 306 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Dark Basement
  • Local time:07:20 AM

Posted 17 December 2017 - 09:21 AM

You need not worry.....these 2 processes are mearly to give your network IpV6 capabilities over IpV4.

 

They are not malicious.

 

The best way to secure your home network is by utilizing a high end router, and configuring it correctly.

 

Is this what you wish to do?


Edited by Replicator, 17 December 2017 - 09:23 AM.

The quieter you become, the more you are able to hear!
CEH, CISSP @ WhiteHat Computers Pty Ltd

 


#6 Swift44

Swift44
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:20 PM

Posted 17 December 2017 - 01:38 PM

&#160;
Is this what you wish to do?


Yes, I'm mainly just worried about putting my mind at ease and making sure nobody has remote access to my computer or that my internet isn't being re-routed or being intercepted in any way. I've been noticing strange anomalies occurring; ie. cursor moving on its own, programs and icons being deleted unexpectedly, weird e-mails in different languages, My bitdefender anti-virus popping up in Russian or some other language I've never seen, huge spikes in number of junk emails, etc. I'm starting to feel like I'm being paranoid but it's just too many things that add up that have me a little freaked out.

I've got my router and modem both locked down tight with strong admin and wifi passwords, firewall enabled, UPnP, telnet, ssh disabled, but I don't feel like it really does a whole lot if I were to unknowingly pick up a virus from using public wifi.  If I were to use an old computer to build a UTM system using Sophos UTM Home Edition would that help to mitigate issues if I have a computer that's already infected? Would that help to prevent my traffic from being intercepted at all?

Edited by Swift44, 17 December 2017 - 02:01 PM.


#7 Replicator

Replicator

  • Members
  • 306 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Dark Basement
  • Local time:07:20 AM

Posted 17 December 2017 - 11:51 PM

I've got my router and modem both locked down tight with strong admin and wifi passwords, firewall enabled, UPnP, telnet, ssh disabled

Good work, this is the basis for formulating a secure network, now we have to look at the other issues of protecting the operating systems of those computers that connect to it so as not to open any doors.

but I don't feel like it really does a whole lot if I were to unknowingly pick up a virus from using public wifi.

Precisely.....The weakest link in any network, particularly server enviroments, is the user!

 

There are a few options such as your suggestion of utilizing UTM which would help, but it wont totally protect you if your operating system is somehow compromised.

 

Here is what I do on public WiFi...........My number 1 goal is to isolate my main operating system on the machine I am using. I want to keep this 'clean' and away from prying eyes.

On my win10 Pro laptop, I set up a Virtual Machine running a Linux distro (either Kali, Mint18 Sarah, or Ubuntu) through Oracle Virtual Box. Linux is superior in configuration options and much harder than windows to infect.

I don't keep any sensitive data on my VM, I simply use it to connect to and utilize P/Wifi and hotspots if I need to, thus isolating my main windows enviroment.

As an extra measure, I run Iptables and ClamAV on the VM configured with a ClamAV-daemon for automation.

I don't run the VM on my own network when I get back at home as I have no need to do so, thus I'm also isolating the network from anything I may have picked up at the local bar (if you know what I mean) as well.

 

Effectively, if by some chance the VM distro is compromised, I can just simply wipe it and reinstall it within about 10 minutes, fearing nothing.

Does this make sense?

Some may say this is over the top, but in todays online environment, I don't think so.....its just an added layer you can use for protection on Public access.

 

Remember, when your on your own network at home always obey the rules! 

Always keep all of your software up to date!

Don't click links that are from prompts (ie update Adobe reader or flash player etc etc) If you think anything may need updating, do it from the legitimate site in the URL bar.

Don't fall for Social Engineering methods to trick you into clicking, or visiting anything you shouldn't. No matter how legit it may seem, always do your research first (ie  Great holiday deals NOW or Phishing emails with links or attachments etc).

Never open mail you don't recognize or your suspect on.

Be careful on Peer-to Peer platforms like Utorrent etc.

 

Anyway, you get the drift.......If it sounds too good to be true, it usually is! There is no such thing as a free lunch on todays www 

 

If you can develop good security configurations, and good browsing habits, you will be well ahead of the pack and always get a good nights sleep!  :thumbup2: 

 

Rep


The quieter you become, the more you are able to hear!
CEH, CISSP @ WhiteHat Computers Pty Ltd

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users