Avast WEBforum

Other => Viruses and worms => Topic started by: REDACTED on January 06, 2015, 03:52:04 AM

Title: Possible hacker? Netstat -ano
Post by: REDACTED on January 06, 2015, 03:52:04 AM
Hey everyone, I have a quick question!

First though, I had a problem with some scareware popup that would install a virus onto one's computer when it appeared. Anyways, I feel like I dealt with all of that, but, when checking the cmd console, I'm getting this awful feeling. 127.0.0.1 is saying it is established and I know it is meant to be a localhost loopback address. However, I'm worried that it might not be mine.

Quote
TCP    127.0.0.1:49168        127.0.0.1:49169        ESTABLISHED     1568
  TCP    127.0.0.1:49169        127.0.0.1:49168        ESTABLISHED     1568

  TCP    127.0.0.1:49171        127.0.0.1:49172        ESTABLISHED     1568
  TCP    127.0.0.1:49172        127.0.0.1:49171        ESTABLISHED     1568

  TCP    192.168.0.101:49262    77.234.43.64:80        ESTABLISHED     1568

As you can see, that PID of 1568 appears a few times under a different address. And yes, I had chrome open and avast running a scanner at the time I was checking. Last time I checked, before I downloaded avast, I didn't have that address. So I'm a little worried. The ones under 6344 are Chrome.

One last thing, avast had listed friendly IP addresses, and while I deleted them, there were a few of them, and not all of them were standard IP addresses either. now, I should have made a screen shot, but I am wondering if that is standard for avast to do or should I be concerned about somebody tampering with my computer?

Lastly, when I was getting rid of the problem, which turned out I did have 2 threats, I eliminated them. However, despite scanning multiple times, I am getting a clean result. Yet, maybe through paranoia, I am worried I am not quite getting the threat completely. Also, when I got the popup scareware thing, I was using chrome, so it might have saved my butt. Maybe. The pop up was some weird thing that was a problem in 2012, yet I got it just this Friday. Yuck. I didn't even visit any sites I haven't visited before to make matters worse, so that is why I am worried that it might be a problem even deeper than it appears.  :-\
Title: Re: Possible hacker? Netstat -ano
Post by: REDACTED on January 06, 2015, 04:30:45 AM
Sorry for the double post, but I double checked with Currports, and I am getting it from Adobe. But I am still concerned.

One last thing: I have run Malwarebytes as well as Hitman Pro, and they seem to be coming up clean as of right now.
Title: Re: Possible hacker? Netstat -ano
Post by: polonus on January 06, 2015, 02:33:58 PM
The traffic is from avast streaming updates.

polonus
Title: Re: Possible hacker? Netstat -ano
Post by: REDACTED on January 08, 2015, 09:02:00 AM
The traffic is from avast streaming updates.

polonus
Yup looks like it. Everything seems to be functioning normally! Thanks anyways. If I do have trouble later, I'll update!
Title: Re: Possible hacker? Netstat -ano
Post by: polonus on January 08, 2015, 03:04:55 PM
You are welcome. Stay safe and secure both offline and online,

polonus