Analysing an intruder....

[scheherazade]

So, I've been monitoring my traffic (statistics only), and I've found that when the machine is idle for long enough, I start uploading at about 40k/sec to somewhere.

I say somewhere, because usually the process is gone by the time I check my stats, and I'm not dumping all the data.

(It usually nabs about 130 megabytes per night).

Well, I managed to nab it in action yesterday morning.
Unfortunately, in my haste I killed the app before taking a dump of the image (derp).

Apparently the image name changes. It seems like it may be using the last image name that the user used.
For example, it shows up as "delete multiple items" if the last thing I did was shift+delete.

I've been trying to nab it in action again since then, but I can't think of a way to get a handle on it.
I might be forced to just write a program that uses windows performance counters to check for IO throughput, and save the associated image.

I could leave wireshark running, but that would dump an insane amount of data, and I wouldn't even know where to que into it to inspect what was going out. (I'm not a wireshark guru though, if anyone knows how I should do this, let me know ).

I want to figure out what files the app is accessing (which I'll do with procmon), but also want to dump all the outbound data to a file and analyze the packets. This may be hard since the image isn't consistently named.

Anyone have/recommend any tools for this? Something like wireshark, but more easily triggered on a few different criteria such as : screensaver active && uploading > 20k/s, etc?

I'm not trying to stop it just yet. I want to learn as much about it as I can before whacking it.

-scheherazade

[complacent]

i've always been a "start at wireshark and work your way backwards" kinda guy.

space is cheap. i'd say run wireshark for a night. it's easy enough to apply filters to saved captures to isolate types of traffic... perhaps a pattern will jump out at you.

[scheherazade]

Can wireshark be set to play a sound when an event is triggered?

I'd love it to wake me up when the upload starts, so I can look at some runtime stuff...

-scheherazade

[complacent]

i don't think it can trigger a sound. i think the best it can do is create a color filter based on certain events.

for example, you could use a tcp zero window to start flagging traffic a certain color...might turn up if someone is trying to move data in a hurry.

[scheherazade]

I'm an idiot.

http://www.akamai.com/html/misc/akamai_ ... e_faq.html

Some gay web site required that I install a support app to view their movies (which includes an akamai service).

Apparently, this makes every client a content delivery node.

According to the last point listed on the link above, clients become hosts when they're being underutilized - to make the service unintrusive...

Which is why I would see it happening over night when the machine was idle.

Serves me right for not reading the fine print. My bad.

Anyways... I read up on it and apparently it's legit (legit in the sense that akamai has major industry customers).

Regardless, service (svchost.exe -k akamai) disabled.

Panicked for no reason.


Edit :
The wierd exe/app name must have been a coincidence.
I bet that my delete multiple items process hung on exit, and when I taskkilled it, I just happened to do it at the same time as when the akamai upload stopped - and I presumed a relationship.
Anyways, I'll still monitor my traffic just in case. But I think this one is figured out.


And yeah, wireshark + process explorer pointed right to it.

-scheherazade

[Mr Kleen]

Some gay web site required that I install a support app to view their movies (which includes an akamai service).

guess you'll have to deal with it so long as you want to watch gay videos from that gay web site.


there's nothing wrong with watching gay videos. using "gay" as a pejorative on the other hand...

[scheherazade]

Different "gay".
Think of it like "bat"[with wings] and "bat" [for baseball].

This southpark clip pertains well (even though it's for a different word).
[NSFW]
http://www.southparkstudios.com/full-ep ... the-f-word

I know homosexuals that call stupid stuff "gay". It's 2010.

-scheherazade

[Mr Kleen]

I know homosexuals that call stupid stuff "gay". It's 2010.

and Lil' Wayne drops the N-bomb.
you're right it IS 2010. you're obviously a very intelligent guy, you can think of a better word that isn't bigoted.

[drwrx]

Wait, isn't this the the season to dawn our gay apparel?
Fa La La La La La La La La