Last night I noticed I can't connect to the internet. I checked my Arch Linux installation, and it was fine. Indeed, my Android phone was fine too.
After some digging, I tried to disable 'Automatically Detect Settings' in Internet Options > LAN Settings.
It worked. However, this makes me very concerned. I've never set up a proxy before, and I live with two others who aren't that tech savvy either. Therefore, I'm concerned I might have picked up a virus which is monitoring my web traffic.
To get more information, I typed in to chrome: chrome://net-internals/#proxy
Which shows the following:
PAC script: http://wpad/wpad.dat
Source: SYSTEM
Upon checking inside wpad.dat we see the following javascript:
function FindProxyForURL(url, host) {
if (isPlainHostName(host) ||
dnsDomainIs(host, ".windowsupdate.com") ||
dnsDomainIs(host, ".microsoft.com") ||
dnsDomainIs(host, ".baidu.com") ||
dnsDomainIs(host, ".kaspersky.com") ||
dnsDomainIs(host, ".live.com") ||
isInNet(host, "10.0.0.0", "255.0.0.0") ||
isInNet(host, "172.16.0.0", "255.255.224.0") ||
isInNet(host, "192.168.0.0", "255.255.0.0") ||
isInNet(host, "127.0.0.0", "255.0.0.0"))
return "DIRECT";
else
return 'PROXY 185.93.3.120:8080';
};
To be honest, I'm not sure what this function does. My guess is that if the URL matches any of the following hostnames, it will serve a direct connection. Else, it will use the proxy. This means virtually every website is routed through that proxy.
I decided to run netstat to see if I can find any connections going to 185.93.3.120:8080.
C:\Windows\system32>netstat -b
Active Connections
Proto Local Address Foreign Address State
TCP 192.168.8.6:49693 hk2sch130021322:https ESTABLISHED
WpnService
[svchost.exe]
TCP 192.168.8.6:49715 104.16.60.37:https ESTABLISHED
[Discord.exe]
TCP 192.168.8.6:49880 hk2sch130021554:https ESTABLISHED
[OneDrive.exe]
TCP 192.168.8.6:49938 hk2sch130022123:https ESTABLISHED
WpnService
[svchost.exe]
TCP 192.168.8.6:50076 a104-89-139-149:https CLOSE_WAIT
[WinStore.App.exe]
TCP 192.168.8.6:50077 a104-89-139-149:https CLOSE_WAIT
[WinStore.App.exe]
TCP 192.168.8.6:50079 a104-89-139-149:https CLOSE_WAIT
[WinStore.App.exe]
TCP 192.168.8.6:50467 tl-in-f108:imaps ESTABLISHED
OneSyncSvc_3b12c
[svchost.exe]
TCP 192.168.8.6:50568 tl-in-f188:5228 ESTABLISHED
[chrome.exe]
TCP 192.168.8.6:50699 ns329092:http CLOSE_WAIT
[Discord.exe]
TCP 192.168.8.6:50701 ns329092:http CLOSE_WAIT
[chrome.exe]
TCP 192.168.8.6:50702 ns329092:http CLOSE_WAIT
[Discord.exe]
TCP 192.168.8.6:50704 ns329092:http CLOSE_WAIT
[chrome.exe]
TCP 192.168.8.6:50766 ns329092:http CLOSE_WAIT
[Code.exe]
TCP 192.168.8.6:50870 67.27.43.254:http ESTABLISHED
DoSvc
[svchost.exe]
TCP 192.168.8.6:50871 67.27.43.254:http TIME_WAIT
TCP 192.168.8.6:50872 67.27.43.254:http ESTABLISHED
DoSvc
[svchost.exe]
TCP 192.168.8.6:50873 67.27.43.254:http ESTABLISHED
DoSvc
[svchost.exe]
TCP 192.168.8.6:50877 67.27.43.254:http ESTABLISHED
DoSvc
[svchost.exe]
TCP 192.168.8.6:50879 67.27.43.254:http ESTABLISHED
DoSvc
[svchost.exe]
TCP 192.168.8.6:50880 67.27.43.254:http ESTABLISHED
DoSvc
[svchost.exe]
TCP 192.168.8.6:50884 67.27.43.254:http ESTABLISHED
DoSvc
[svchost.exe]
TCP 192.168.8.6:50890 67.27.43.254:http TIME_WAIT
TCP 192.168.8.6:50892 67.27.43.254:http ESTABLISHED
DoSvc
[svchost.exe]
TCP 192.168.8.6:50893 67.27.43.254:http ESTABLISHED
DoSvc
[svchost.exe]
TCP 192.168.8.6:50895 67.27.43.254:http ESTABLISHED
DoSvc
[svchost.exe]
Another time I forgot the -b flag, but noticed it connected to stackoverflow, when I couldn't connect to the internet at all:
TCP 192.168.8.6:50643 stackoverflow:https ESTABLISHED
The problem is fixed by: Internet Properties > LAN Settings > Automatically detect settings (Uncheck it)
I am concerned I have a virus that is monitoring my internet traffic. I just reformatted two weeks ago, and haven't installed an anti-virus yet.
The wpad.dat is concerning, specifically return 'PROXY 185.93.3.120:8080';
. I have NO IDEA why there is a wpad.dat on my network.
Is this file being served by the router? By the ISP? By my computer?
How can I know if this is malicious or not?
To clarify, I can connect now, but I couldn't connect yesterday, and the following steps I've taken above were to diagnose it. I'm not satisfied with the internet working now - I want to know what is wrong here.
Thanks.