PDA

View Full Version : Alexa hogging ports, not detected by Spybot


PortalGuy
2013-01-23, 15:46
Folks,

Please advise. Just found Alexa on many high ports. Spybot doesn't detect it: is Alexa now whitelisted?

Cannot find any running process, service, BHO or startup that seems to be associated with Alexa. What starts Alexa and how can I stop and get rid of it?

Per the instructions I've attached the DDS and aswMBR logs below. Below please find the output of netstat -a | grep alexa.

Thanks!
Robert

netstat -a | grep alexa

TCP 127.0.0.1:12080 alexa:63716 ESTABLISHED
TCP 127.0.0.1:12080 alexa:63719 ESTABLISHED
TCP 127.0.0.1:12080 alexa:63720 ESTABLISHED
TCP 127.0.0.1:12080 alexa:63722 ESTABLISHED
TCP 127.0.0.1:12080 alexa:63724 ESTABLISHED
TCP 127.0.0.1:12080 alexa:63725 ESTABLISHED
TCP 127.0.0.1:12080 alexa:63737 ESTABLISHED
TCP 127.0.0.1:27275 alexa:63764 TIME_WAIT
TCP 127.0.0.1:27275 alexa:63765 TIME_WAIT
TCP 127.0.0.1:27275 alexa:63766 TIME_WAIT
TCP 127.0.0.1:27275 alexa:63767 TIME_WAIT
TCP 127.0.0.1:27275 alexa:63768 TIME_WAIT
TCP 127.0.0.1:27275 alexa:63769 TIME_WAIT
TCP 127.0.0.1:27275 alexa:63770 TIME_WAIT
TCP 127.0.0.1:27275 alexa:63771 FIN_WAIT_2
TCP 127.0.0.1:49155 alexa:3979 ESTABLISHED
TCP 127.0.0.1:57765 alexa:57766 ESTABLISHED
TCP 127.0.0.1:57766 alexa:57765 ESTABLISHED
TCP 127.0.0.1:57772 alexa:57773 ESTABLISHED
TCP 127.0.0.1:57773 alexa:57772 ESTABLISHED
TCP 127.0.0.1:60627 alexa:60630 ESTABLISHED
TCP 127.0.0.1:60630 alexa:60627 ESTABLISHED
TCP 127.0.0.1:63710 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63712 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63713 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63715 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63716 alexa:12080 ESTABLISHED
TCP 127.0.0.1:63718 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63719 alexa:12080 ESTABLISHED
TCP 127.0.0.1:63720 alexa:12080 ESTABLISHED
TCP 127.0.0.1:63722 alexa:12080 ESTABLISHED
TCP 127.0.0.1:63724 alexa:12080 ESTABLISHED
TCP 127.0.0.1:63725 alexa:12080 ESTABLISHED
TCP 127.0.0.1:63731 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63732 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63734 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63735 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63736 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63737 alexa:12080 ESTABLISHED
TCP 127.0.0.1:63739 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63740 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63741 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63742 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63744 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63746 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63749 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63751 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63754 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63759 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63762 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63771 alexa:27275 CLOSE_WAIT
TCP 127.0.0.1:63773 alexa:21322 TIME_WAIT
TCP 127.0.0.1:63778 alexa:21322 TIME_WAIT

=====
PortalGuy
2013-01-23, 15:56
PS

The following sure does inspire confidence ;)

Alexa is running with a PID of 1636. So....

taskkill /F /PID 1636
ERROR: The process with PID 1636 could not be terminated.
Reason: Access is denied.
tashi
2013-01-23, 16:29
Hello PortalGuy, :welcome:

In case you missed the post please see Personal computers (http://forums.spybot.info/showpost.php?p=25712&postcount=5)

Best regards. :)
PortalGuy
2013-01-23, 16:44
This is my personal laptop, thanks. If it were a company laptop I'd have them reimage it and not bother with trou


Hello PortalGuy,

In case you missed the post please see Personal computers (http://forums.spybot.info/showpost.php?p=25712&postcount=5)

Best regards. :)
PortalGuy
2013-01-23, 16:46
...not bother with troubleshooting. Sorry.


This is my personal laptop, thanks. If it were a company laptop I'd have them reimage it and not bother with trou
tashi
2013-01-23, 17:36
Hi there,


This is my personal laptop, thanks.
One of the tags you'd placed on this topic, "corporate". ;)

Could you start a new topic please and provide the logs as shown in post #2 and in one post.

http://forums.spybot.info/showpost.php?p=1150&postcount=2



Instruction for producing the DDS and aswMBR logs


DDS Log

Download to your desktop DDS from one of the links below:

Link 1 (http://download.bleepingcomputer.com/sUBs/dds.scr)
Link 2 (http://download.bleepingcomputer.com/sUBs/dds.com)


Double click the tool to run it.
If a black Screen opens, just read the contents and do nothing.
When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
Copy/Paste the contents of 'DDS.txt' into your post. Please do not use code wrap.

'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files) (http://windows.microsoft.com/en-us/windows-vista/Compress-and-uncompress-files-zip-files)



aswMBR Log

Important! Please do not perform any fix options offered in aswMBR

Please download aswMBR (http://public.avast.com/%7Egmerek/aswMBR.exe) to your desktop.



Double click the aswMBR icon to run it.
Click the Scan button to start scan.
If you are asked to update the Avast Virus database please allow it to do so.
When it finishes, press the Save Log button, save the logfile to your desktop and post its contents in your reply with the DDS logs.

Best regards. :)
PortalGuy
2013-01-23, 19:45
Thanks for the advice.

I tagged it 'corporate' because Alexa seems to be a corporate solution.

MODS, please feel free to delete this thread.

Robert
tashi
2013-01-23, 20:07
New topic: http://forums.spybot.info/showthread.php?t=67664