Unknown Service Downloading from IP

[P00HB33R]

Hi Guys,

I've got a client and his laptop has got an unknown service that is downloading from IP 165.165.16.16. I've blocked the IP but the service just changes the IP in the same range. Is there anyway one can remove this service? Where should one start looking?

Thank you in advance

 

[ben dover]

Start->Run
Type msconfig
In the services tab, make sure it's set not to start up.

In sounds however like a virus, so make sure the startup entry is also removed.
There's a program called "CCleaner" which can delete startup entries that may be hidden in msconfig.

Lastly, get yourself a good antivirus like "Avast" and run a Boot time scan.

Good luck

 

[TheMightyQuin]

Hi Guys,

I've got a client and his laptop has got an unknown service that is downloading from IP 165.165.16.16. I've blocked the IP but the service just changes the IP in the same range. Is there anyway one can remove this service? Where should one start looking?

Thank you in advance

I sincerely hope that this guy is not your IT services client?!

 

[The_Unbeliever]

Block the IP with its subnet.

eg 165.165.16.16/24

See what happens.


A full scan with up-to-date antivirus and so on is definitely recommended.

 

[bubbatentoe]

goto command prompt and type "netstat /b" and then "netstat /o"
these 2 commands will show you the program and process ID that's responsible for opening connections to 165.165.16.16

then open task manager and find the program/process responsible and kill it.
but it'll probably come back after a minute or after a reboot..

Like Ben says, keep the PC clean with anti-spyware/malware/virus software.