Fiddler show external requests but not initiated by any legitimate process

Question

While debugging my web application in Fiddler, I found out that there are some suspicious requests to some hotel sites, search requests to google.pl. etc. See below images. Strangely there no process displayed in Fiddler.

Fiddler network packet trace Suspicious packet

It's definitely a virus. I don't know how to find out which software or process is causing it. Any help to further analyze and secure my system is highly appreciated.

Maybe other tools like microsofts network monitor show the process? — user78244, Jun 26 '15 at 12:22
If your are using windows then try using the `netstat -b` to see what executable is making requests — ρss, Jun 26 '15 at 12:50

score 1 · Answer 1 · answered May 17 '17 at 17:39

You won't see a process if the request is not from the local machine, I.E., if you are allowing other machines to proxy via Fiddler. Check the Tools | Telerik Fiddler Options menu, and on the Connections tab, see if "Allow remote computers to connect" option is checked. If it is, this is likely where these requests are coming from, and why you can't identify the process they're associated with.

score 0 · Answer 2 · answered Oct 25 '15 at 02:18

I would suggest Sysinternals: https://technet.microsoft.com/en-us/sysinternals/default.aspx.

These tools are good to have in your toolkit when investigating odd behavior:

TCPView - https://technet.microsoft.com/en-us/sysinternals/bb897437
Autoruns - https://technet.microsoft.com/en-us/sysinternals/bb963902
Process Explorer - https://technet.microsoft.com/en-us/sysinternals/bb896653
Process Monitor - https://technet.microsoft.com/en-us/sysinternals/bb896645

TCPView

TCPView will show you open connections and let you force close connections.

Autoruns

This program shows you programs that are set to start on boot and will let you remove them from autostarting. Windows has a number of places that programs can get injected to autostart.

Process Explorer and Process Monitor

These programs allow you to view running processes, ownership information, open files and open ports, dump memory owned by the process, and let you kill these programs.

score 0 · Answer 3 · answered Jun 26 '15 at 17:06

0

Microsoft's TCPView will show the link between processes and network connections:

https://technet.microsoft.com/en-us/library/bb897437.aspx

answered Jun 26 '15 at 17:06

1

used this, looks good however problem is that those connections closes very fast. by the time I observe and click on it it vanishes. Luckily I could click on one ( I think I did ) but it says system and PID is 0. also some says netbios – Kiran Ambati Jun 30 '15 at 05:54

k1DBLITZ · Answer 4 · 2015-06-26T18:47:09.040

0

You can try:

netstat -abn

Which will show the process, if available.

You can also try:

netstat -aon

Which will show the PID which you can then lookup in the task manager.

However, it may not show up in either of those places depending upon how stealthy it is. If it doesn't show up there are techniques to use things like Logman logging Winsock activity, but it gets a little complicated from there.

edited Jun 26 '15 at 18:47

answered Jun 26 '15 at 18:34

k1DBLITZ

3,933
14
20

Both commands dint give much info. probably because connections is not continuous it is connecting and closed in a split second. – Kiran Ambati Jun 30 '15 at 05:51
1

For the time being, you could add an entry in your hosts file to route www.google.pl to 0.0.0.0 until you can track this thing down. – k1DBLITZ Jun 30 '15 at 13:23
Good idea!. This will reduce one url :) – Kiran Ambati Jun 30 '15 at 19:18

Fiddler show external requests but not initiated by any legitimate process

4 Answers4

TCPView

Autoruns

Process Explorer and Process Monitor