Re: Stats show malware activity but scans find no threat - Page 2

proof1st · ‎01-12-2015

I have had OpenDNS set up at my router, working great for a couple years. In the network stats lately I'm noticing what appears to be activity that indicates some malware has infected one of the systems on the network - blocked domains for adware, spam, porn etc. and a surge in requests.

Ive scanned all my systems using avast antivirus free version, malwarebytes, adw cleaner and have found no threats.

What should be my next step in finding the source?

thanks!

ericsolo1 · ‎01-17-2015

The domain ib.adnx.com is a legit advertising platform,but used by adware to display popups and banner ads that I guess must be removed by deleting the affected program. It was interesting to read that many of the requests can come from multiple sources on a single web site. I guess I need to understand a request is not just some one entering a site in the browser window but can be generated many other ways. It's just troubling to see requests for porn sites or peer to peer file sharing when those are the main reason I installed Open DNS after finding our children going to these sites. If they picked up some type of re-direct code we have no one to blame but ourselfs. I appreciate all the input.

mattwilson9090 · ‎01-17-2015

If OpenDNS is blocking requests to those types of domains, then it is doing precisely what you wanted it to do. Why would you be troubled if it's doing what it is supposed to do?

Just because you see an adware domain being blocked does not mean that you have an infection or someone is visiting a website you don't want them to. It just means that something is trying to do a look up on that domain. Typical advertising on any website could very easily be doing that and and OpenDNS is blocking the lookup, which is how OpenDNS should work, and prevents that content from being accessed on your network and prevents potential infections from getting a foothold.

If you are concerned about the domains that ib.adnx.com is providing advertisements for you should blacklist that domain, although there is a possibly that it will break websites that are using the ad engine.

If you have convinced yourself that malware is present in your network you should 1) change the WiFi passphrase in case someone is using your network that you don't wnat on it 2) shutdown, disconnect, or unplug *all* internet connected devices when no one is there, such as computers, tablets, mobile phones, Roku's, SmartTV's etc. If no one is there for longer than 2 days and there is still internet activity then you have evidence that someone who is not supposed to be using your network is using it 3) thoroughly scan all devices with multiple pieces of malware detection software in addition to your regular antivirus software 4) confirm that the time zone setting in your OpenDNS account matches the time zone you are in and matches that set on your devices 5) hire an IT/security professional to make a thorough examation of your network and all devices connected to it to find and remove all malware that is present and prevent future infections

rotblitz · ‎01-18-2015

@ericsolo1
Look, if you didn't use OpenDNS, you would be aware in no way about your DNS queries and you wouldn't care at all. Now, that you know and that these offending DNS queries are even blocked, why do you care?

"These requests cant be "Normal" web browsing and have to be software generated."

Yes, of course, DNS queries are never human generated (unless one uses dig, nslookup, host and the likes), but always networking application generated. Pretty clear!

"I guess I need to understand a request is not just some one entering a site in the browser window but can be generated many other ways."

Yes, and tools like http://www.nirsoft.net/utils/dns_query_sniffer.html or www.webpagetest.org can help here. For the latter, after the results are collected, click the Domain tab to see what domains are participating. This can be dozens for a web page.

"It's just troubling to see requests for porn sites or peer to peer file sharing when those are the main reason I installed Open DNS after finding our children going to these sites."

Yes, but these are being blocked according to your stats, are they? So, why are you worried? As Matt Wilson said, you exactly get what you expected!

ericsolo1 · ‎01-19-2015

Thanks for the leads,Ill check these resources out. I could rack my brain with adding computer sciences knowledge until it pushes out the stuff I need for my field,or I could retire this paranoia and move on to something more productive. Seriously though this input has been incredibly interesting and leaves me wanting to learn more. From a service point of view the response from staff and community of Open DNS has been very impressive. I will upgrade to paid level out of shame.

mfuhr · ‎01-16-2016

Thanks for the discussion - I have the same issue, only when I iunplug all my devices it still shows queries from load.exelator and loadr.exelator - and in regard to being bothered by the blocked porn requests I am glad they are being blocked but potentially disturbed if my kids are making those requests. I'm pretty convinced they are not, but who would it be and why would my system be making porn requests when nobody is even home?

rotblitz · ‎01-16-2016

"it still shows queries from load.exelator and loadr.exelator"

These are not public DNS names, or did you mean load.exelator.com and loadr.exelator.com? These are domains used by a provider exelate.com to utilize their services on other websites, like marketing, advertising and tracking. This website has a lousy reputation:
https://www.mywot.com/en/scorecard/exelate.com
See also http://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning/what-is-loadjs-from-loadmexelatorcom/12b1d9dc-642f-449d-baf6-a9aadae91dad?auth=1
And if you have the Adware category blocked, these domains will be blocked too:
https://community.opendns.com/domaintagging/search/?q=exelator.com

"in regard to being bothered by the blocked porn requests I am glad they are being blocked but potentially disturbed if my kids are making those requests. I'm pretty convinced they are not"

If you followed the discussion above thoroughly, you knew that DNS lookups are not raised by humans inc kids, but by networking applications and devices anyway. So yes, you're right, these aren't your kids or anybody else unless they did enter DNS lookup commands against these domains all the time.

"who would it be and why would my system be making porn requests when nobody is even home?"

Not "who", but "what" is the question. And nobody can answer your question but you. You may have overseen devices which are still switched on, including your router, or you may have set a wrong time zone as mentioned above too, or someone has access to your internet connection from inside your LAN, e.g. via an unsecured or hacked WLAN AP, or someone has remote access to a device within your network.