Then lastly it has a lot of TCP and HTTP traffic, looking like the one above with code we do not know how to interpret. Then comes a lot of DNS traffic to the aforementioned sites, citibank, twitter and the like. It then does an external address request with NAT-PMP and again gets a 'Destination unreachable' back through ICMP. It starts with an ICMP 'Echo ping request', and then a NBNS 'name query NBSTAT' and gets a 'Destination unreachable' back via ICMP. We are not have the expertises to interpret the wireshark capture, so here is a rough run-down of the events. We set up wireshark on the affected computer and set the filter to capture packets to the destination of the router ip.dst=192.168.1.100 which is the IP of the router. We managed to capture the traffic with wireshark, and to our surprise it is not only trying to log into the router, it is accessing a host of websites like facebook, citibank, bankofamerica, amazon, twitter. We ran a full scan with Avira-live-disc to no avail. The last one is with a genuine windows 7 install and the virus got there presumably through a USB drive, undetected by his anti-virus - Avast. Made the post and thanks to we got a bit closer to figuring our what it was.īoth of his computers have done it. We detected numerous failed admin login attempts by two computers on our LAN to our router and found it suspicious. This is a continuation of another post I made Computer on my home network tries to log into router

Can wireshark captures be detected