Greetings to you lovely and helpful technophiles,
First off, I am new to diagnosing & troubleshooting network leaks or what seem to me like highly suspicious network activity. Although I have a decent tech history, so I should be able to follow any advice without much difficulty.
So the problem seems to be coming from multiple connections coming through to my network. I am able to view this suspicious activity using COMODO Killswitch, which allows me to monitor several connections at once. I created a small log of the suspicious connections. I have pasted that info below and I also included a link to the a google doc spreadsheet if you would prefer to view it that way.
KillSwitch
2015-12-24 07:11:53 Thursday
Network Connections (81) View:
Protocol Local Address Local Port Remote Address Remote Port State Sent Traffic Received Traffic Owner
svchost.exe(532) 0 0
TCP ads.e-go.gr 135 ads.e-go.gr Listen RpcSs
TCP6 JoeDirt-PC 135 JoeDirt-PC Listen RpcSs
System(4) 165.22 KB 137.10 KB
TCP JoeDirt-PC 139 ads.e-go.gr Listen
TCP ads.e-go.gr 1723 ads.e-go.gr Listen
TCP ads.e-go.gr 443 ads.e-go.gr Listen
TCP ads.e-go.gr 445 ads.e-go.gr Listen
TCP6 JoeDirt-PC 443 JoeDirt-PC Listen
TCP6 JoeDirt-PC 445 JoeDirt-PC Listen
UDP JoeDirt-PC 137
UDP JoeDirt-PC 138
TCP JoeDirt-PC 139 ads.e-go.gr Listen
UDP JoeDirt-PC 137
UDP JoeDirt-PC 138
wininit.exe(752) 0 0
TCP ads.e-go.gr 5000 ads.e-go.gr Listen
TCP6 JoeDirt-PC 5000 JoeDirt-PC Listen
svchost.exe(1208) 50.13 KB 28.15 KB
TCP ads.e-go.gr 5001 ads.e-go.gr Listen eventlog
TCP6 JoeDirt-PC 5001 JoeDirt-PC Listen eventlog
svchost.exe(1308) 66 B 0
TCP ads.e-go.gr 5002 ads.e-go.gr Listen Schedule
TCP6 JoeDirt-PC 5002 JoeDirt-PC Listen Schedule
UDP ads.e-go.gr 500 IKEEXT
UDP ads.e-go.gr 4500 IKEEXT
UDP ads.e-go.gr 64399 RemoteAccess
UDP6 JoeDirt-PC 500 IKEEXT
UDP6 JoeDirt-PC 4500 IKEEXT
UDP6 JoeDirt-PC 53986 RemoteAccess
UDP6 JoeDirt-PC 53987 RemoteAccess
services.exe(812) 0 0
TCP ads.e-go.gr 5003 ads.e-go.gr Listen
TCP6 JoeDirt-PC 5003 JoeDirt-PC Listen
lsass.exe(848) 0 0
TCP ads.e-go.gr 5004 ads.e-go.gr Listen
TCP6 JoeDirt-PC 5004 JoeDirt-PC Listen
MediaMonkey.exe(6260) 178.19 KB 0
TCP ads.e-go.gr 58378 ads.e-go.gr Listen
UDP ads.e-go.gr 1065
UDP ads.e-go.gr 1900
svchost.exe(7708) 88 B 0
UDP JoeDirt-PC 427 HPSLPSVC
UDP ads.e-go.gr 427 HPSLPSVC
UDP JoeDirt-PC 427 HPSLPSVC
svchost.exe(1300) 7.62 KB 106.99 KB
UDP JoeDirt-PC 1900 SSDPSRV
UDP JoeDirt-PC 1900 SSDPSRV
UDP6 JoeDirt-PC 1900 SSDPSRV
UDP6 JoeDirt-PC 1900 SSDPSRV
UDP JoeDirt-PC 1900 SSDPSRV
UDP JoeDirt-PC 51760 SSDPSRV
UDP JoeDirt-PC 51761 SSDPSRV
UDP JoeDirt-PC 51762 SSDPSRV
UDP6 JoeDirt-PC 1900 SSDPSRV
UDP6 JoeDirt-PC 51757 SSDPSRV
UDP6 JoeDirt-PC 51758 SSDPSRV
UDP6 JoeDirt-PC 51759 SSDPSRV
svchost.exe(1132) 194.36 KB 476.05 KB
UDP ads.e-go.gr 5355 Dnscache
UDP6 JoeDirt-PC 5355 Dnscache
ScpService.exe(1932) 0 0
UDP JoeDirt-PC 26760 Ds3Service
As you can see, it is rather suspicious that my computer is connecting multiple system files to ads.e-go.gr I did some research into this company and website and found it to be a Greek Ad and Marketing company, called Adman by a group called Phaistos Networks.
Here are the associated websites.
http://phaistosnetworks.gr/products/adman
http://admanadmin.e-go.gr/login
So I am really hoping you guys can help me out with this. The only way I can see to terminate these connections is to also terminate the various critical system files that are running under various programs, svchost, and other essential services.
I also find it strange that these connections are also included in some personal programs such as media monkey and my VPN services.
I really do appreciate your help in this. I really don’t know where or how to start cleaning up this problem with my network. Now I am assuming it truly is a problem, if you know otherwise I would appreciate an explanation on how this is not a security issue.
Sincerely,
Solvedidentity