Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Note: Please do not mod down or close. Im not a stupid PC user asking to fix my pc problem. I am intrigued and am having a deep technical look at whats going on.

I have come across a Windows XP machine that is sending unwanted p2p traffic.

I have done a 'netstat -b' command and explorer.exe is sending out the traffic. When I kill this process the traffic stops and obviously Windows Explorer dies.

Here is the header of the stream from the Wireshark dump (x.x.x.x) is the machines IP.

GNUTELLA CONNECT/0.6
Listen-IP: x.x.x.x:8059
Remote-IP: 76.164.224.103
User-Agent: LimeWire/5.3.6
X-Requeries: false
X-Ultrapeer: True
X-Degree: 32
X-Query-Routing: 0.1
X-Ultrapeer-Query-Routing: 0.1
X-Max-TTL: 3
X-Dynamic-Querying: 0.1
X-Locale-Pref: en
GGEP: 0.5
Bye-Packet: 0.1

GNUTELLA/0.6 200 OK
Pong-Caching: 0.1
X-Ultrapeer-Needed: false
Accept-Encoding: deflate
X-Requeries: false
X-Locale-Pref: en
X-Guess: 0.1
X-Max-TTL: 3
Vendor-Message: 0.2
X-Ultrapeer-Query-Routing: 0.1
X-Query-Routing: 0.1
Listen-IP: 76.164.224.103:15649
X-Ext-Probes: 0.1
Remote-IP: x.x.x.x
GGEP: 0.5
X-Dynamic-Querying: 0.1
X-Degree: 32
User-Agent: LimeWire/4.18.7
X-Ultrapeer: True
X-Try-Ultrapeers: 121.54.32.36:3279,173.19.233.80:3714,65.182.97.15:5807,115.147.231.81:9751,72.134.30.181:15810,71.59.97.180:24295,74.76.84.250:25497,96.234.62.221:32344,69.44.246.38:42254,98.199.75.23:51230

GNUTELLA/0.6 200 OK

So it seems that the malware has hooked into explorer.exe and hidden its self quite well as a Norton Scan doesn't pick anything up.

I have looked in Windows firewall and it shouldn't be letting this traffic through.

I have had a look into the messages explorer.exe is sending in Spy++ and the only related ones I can see are socket connections etc...

My question is what can I do to look into this deeper? What does malware achieve by sending p2p traffic?

I know to fix the problem the easiest way is to reinstall Windows but I want to get to the bottom of it first, just out of interest.

Edit:

Had a look at Deoendency Walker and Process Explorer.

Both great tools. Here is a image of the TCP connections for explorer.exe in Process Explorer:

enter image description here

share|improve this question

migrated from stackoverflow.com May 15 '10 at 17:27

This question came from our site for professional and enthusiast programmers.

3 Answers 3

Chances are that the trojan is using the p2p network as a command and control channel. since p2p is all about distribution, there is no single point that can be shut down to take down the the botnet.

what you are seeing is probably your pet bot looking for orders.

one idea to look further is to run dependency walker on explore.exe to see what dlls it pulls in, one of them may be the bot.

share|improve this answer

The malware is probably hooking itself onto explorer.exe.

Try using Sysinternals' Processexplorer to find out more: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Sysinternals also has a rootkitscanner which locates hidden files/registry entries.

share|improve this answer

I tried to exterminate the malware and I think that it was successful.

Please search for C:\Windows\halperf10.exe or any .exe file with a comparatively new time stamp similar to it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.