Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

After some recent AV/FW software update (Comodo) and restarting my computer, I was alarmed with big amount of warnings that application "x" (where "x" is pretty much all of what I try to run) try to establish outgoing connection to adress 224.0.0.252 (or sometimes similar adress from same range). Even if it is some dummy app I've just created, or any app that has nothing to do with internet. Besides that "System" process itself tries to send these IGMP requests as well requests. 5 connections per minute on average. There was also increase (or FW update triggered oversensitivity) with traffic on ports 137 and 138 UDP, which I fixed by disabling NetBIOS.

My question is: What can be the cause of this? Is that normal? Did my firewall got oversensitive with the latest update, alarming me of some inner Windows stuff that happens all the time? Or maybe I've catched something malicious (Comodo / Spybot Search and Destroy seem not to raise any red flags). What else I can use to check/clean my system for threats that can be applied over my current AV.FW (Comodo)?

-----Edit-----

Freshly installed system with all updates seem to behaviour same exact way with less intensity so far. Scan with Windows Defender offline didnt revealed any problems.

Im basically out of ideas and still wonder if its caused by some recent system update or maybe faulty firewall software. And if its caused by some rootkit how to reveal it and get rid of it.

share|improve this question
add comment

1 Answer

This sounds like you caught something malicious. If you caught a virus/trojan/spyware that used DLL Injection and in that injected DLL it calls home to that IP address you saw you would see exactly the kind of behaviour you are experiencing.

This also could be a update gone awry from a legitimate program, and that would explain why the antivirus did not catch it, but it is unlikely.

I would recommend going to a different computer you know has no infections and go download Windows Defender Offline. This will let you make a bootable CD/USB (if you make a bootable USB you can update the virus definitions by running the setup program again with the drive plugged in) and it will scan your computer for infections without booting the OS, that way if the infection is blocking the virus scanner from seeing the infected files, launching before windows (and before the virus can get it's hooks in) the offline scan can see the hidden files.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.