0

Last night I noticed I can't connect to the internet. I checked my Arch Linux installation, and it was fine. Indeed, my Android phone was fine too. After some digging, I tried to disable 'Automatically Detect Settings' in Internet Options > LAN Settings. It worked. However, this makes me very concerned. I've never set up a proxy before, and I live with two others who aren't that tech savvy either. Therefore, I'm concerned I might have picked up a virus which is monitoring my web traffic.

To get more information, I typed in to chrome: chrome://net-internals/#proxy

Which shows the following:

PAC script: http://wpad/wpad.dat
Source: SYSTEM

Upon checking inside wpad.dat we see the following javascript:

function FindProxyForURL(url, host) {
    if (isPlainHostName(host) ||
        dnsDomainIs(host, ".windowsupdate.com") ||
        dnsDomainIs(host, ".microsoft.com") ||
        dnsDomainIs(host, ".baidu.com") ||
        dnsDomainIs(host, ".kaspersky.com") ||
        dnsDomainIs(host, ".live.com") ||
        isInNet(host, "10.0.0.0", "255.0.0.0") ||
        isInNet(host, "172.16.0.0", "255.255.224.0") ||
        isInNet(host, "192.168.0.0", "255.255.0.0") ||
        isInNet(host, "127.0.0.0", "255.0.0.0"))
    return "DIRECT";
    else
        return 'PROXY 185.93.3.120:8080';
};

To be honest, I'm not sure what this function does. My guess is that if the URL matches any of the following hostnames, it will serve a direct connection. Else, it will use the proxy. This means virtually every website is routed through that proxy.

I decided to run netstat to see if I can find any connections going to 185.93.3.120:8080.

C:\Windows\system32>netstat -b

Active Connections

Proto  Local Address          Foreign Address        State
TCP    192.168.8.6:49693      hk2sch130021322:https  ESTABLISHED
WpnService
[svchost.exe]
TCP    192.168.8.6:49715      104.16.60.37:https     ESTABLISHED
[Discord.exe]
TCP    192.168.8.6:49880      hk2sch130021554:https  ESTABLISHED
[OneDrive.exe]
TCP    192.168.8.6:49938      hk2sch130022123:https  ESTABLISHED
WpnService
[svchost.exe]
TCP    192.168.8.6:50076      a104-89-139-149:https  CLOSE_WAIT
[WinStore.App.exe]
TCP    192.168.8.6:50077      a104-89-139-149:https  CLOSE_WAIT
[WinStore.App.exe]
TCP    192.168.8.6:50079      a104-89-139-149:https  CLOSE_WAIT
[WinStore.App.exe]
TCP    192.168.8.6:50467      tl-in-f108:imaps       ESTABLISHED
OneSyncSvc_3b12c
[svchost.exe]
TCP    192.168.8.6:50568      tl-in-f188:5228        ESTABLISHED
[chrome.exe]
TCP    192.168.8.6:50699      ns329092:http          CLOSE_WAIT
[Discord.exe]
TCP    192.168.8.6:50701      ns329092:http          CLOSE_WAIT
[chrome.exe]
TCP    192.168.8.6:50702      ns329092:http          CLOSE_WAIT
[Discord.exe]
TCP    192.168.8.6:50704      ns329092:http          CLOSE_WAIT
[chrome.exe]
TCP    192.168.8.6:50766      ns329092:http          CLOSE_WAIT
[Code.exe]
TCP    192.168.8.6:50870      67.27.43.254:http      ESTABLISHED
DoSvc
[svchost.exe]
TCP    192.168.8.6:50871      67.27.43.254:http      TIME_WAIT
TCP    192.168.8.6:50872      67.27.43.254:http      ESTABLISHED
DoSvc
[svchost.exe]
TCP    192.168.8.6:50873      67.27.43.254:http      ESTABLISHED
DoSvc
[svchost.exe]
TCP    192.168.8.6:50877      67.27.43.254:http      ESTABLISHED
DoSvc
[svchost.exe]
TCP    192.168.8.6:50879      67.27.43.254:http      ESTABLISHED
DoSvc
[svchost.exe]
TCP    192.168.8.6:50880      67.27.43.254:http      ESTABLISHED
DoSvc
[svchost.exe]
TCP    192.168.8.6:50884      67.27.43.254:http      ESTABLISHED
DoSvc
[svchost.exe]
TCP    192.168.8.6:50890      67.27.43.254:http      TIME_WAIT
TCP    192.168.8.6:50892      67.27.43.254:http      ESTABLISHED
DoSvc
[svchost.exe]
TCP    192.168.8.6:50893      67.27.43.254:http      ESTABLISHED
DoSvc
[svchost.exe]
TCP    192.168.8.6:50895      67.27.43.254:http      ESTABLISHED
DoSvc
[svchost.exe]

Another time I forgot the -b flag, but noticed it connected to stackoverflow, when I couldn't connect to the internet at all:

TCP    192.168.8.6:50643      stackoverflow:https    ESTABLISHED

The problem is fixed by: Internet Properties > LAN Settings > Automatically detect settings (Uncheck it)

I am concerned I have a virus that is monitoring my internet traffic. I just reformatted two weeks ago, and haven't installed an anti-virus yet. The wpad.dat is concerning, specifically return 'PROXY 185.93.3.120:8080';. I have NO IDEA why there is a wpad.dat on my network. Is this file being served by the router? By the ISP? By my computer? How can I know if this is malicious or not?

To clarify, I can connect now, but I couldn't connect yesterday, and the following steps I've taken above were to diagnose it. I'm not satisfied with the internet working now - I want to know what is wrong here.

Thanks.

2 Answers 2

0

im googling that ip because it was configured as a winhttp in windows 10 and outlook could not connect to 365 exchange with it configured, i have since found out that windows update will change this if it feels like it? http://datacamp.co.uk/ is what the ip points me to.

netsh winhttp reset proxy

https://support.microsoft.com/en-gb/help/900935/how-the-windows-update-client-determines-which-proxy-server-to-use-to

3
  • Are you in Hong Kong or China by any chance? I'm in Hong Kong - I wonder if it has to do with location?
    – Kevin
    Nov 23, 2017 at 15:36
  • UK here, ms updates possibly
    – sam
    Nov 23, 2017 at 16:22
  • Yeah, but why would that mean we can access http://wpad/wpad.dat on non-windows OS's (e.g. Android) too?
    – Kevin
    Nov 23, 2017 at 17:14
0

Same here, I also got this problem since yesterday. Just like you I thought there is a virus monitoring my traffic. I checked wireshark and I could find this ip address 185.93.3.120 but the packets were getting dropped. I did a whois search but did not get much information on it.

Anyways as suggested by you, these steps solved the problem The problem is fixed by: Internet Properties > LAN Settings > Automatically detect settings (Uncheck it)

1
  • 1
    Are you in Hong Kong or China by any chance? I'm in Hong Kong - I wonder if it has to do with location?
    – Kevin
    Nov 23, 2017 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .