Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 252
  • Last Modified:

Netstat showing a virus according to MS

I have a user that called MS tech support and they told him that he has viruses in his computer because they ran a netstat cmd and showed him he had established connections from a virus. I don't buy it because they wanted him to pay for extra support to get rid of it. However when I inspected the computer I tried to download malwarebytes but anything I tried to download froze at 99% and then said failed. I attached the screen shot of the netstat cmd, could someone verify if that's what's happening
4 Solutions
Sajid Shaik MSr. System AdminCommented:
it's showing 3 sessions are established ...
the session  it's mcafee ip

using the following link you can see the which domain you are connecting ..

and go to task manager check the Applications if any unnecessary running if found uninstall then or delete them by finding path..
(select the running application right click go to services. you'll find the service name... search the service name in by search bar in you pc... it'll take you to that application... )

check the high process high memory consuming apps. etc as well..

try download malwarebytes download from other sources.. i.e http://www.majorgeeks.com/mg/getmirror/malwarebytes_anti_malware,3.html

then try ..

still unable to download try to download n safemode with networking...

all the best
Stephen BerkSenior Network EngineerCommented:
If you don't already have an antimalware package on there, you should reimage the machine and install something on all the PCs asap. Even MS' freebie System Essentials (free for noncommercial and possibly small businesses) is better than nothing. Check her call history, she might have been called by someone claiming to be MS or she may have called someone due to a popup saying she's infected and was given a number to call. Either way, you have a PC on your network that may be infecting others. Remove from the network, reimage, take corrective action to prevent recurrence.
You definitely need to check how the user "called MS tech support". It's probably the other way around (a supposed MS tech support called him). Ask how he got the number, and if not from the official website, or not by his idea (cold call), maybe he already started a remote session (because the other side asked him to) and the computer is now actually infected because of the session (and files have been put on the PC).

Next, send out an company wide email. IT'S NOT LOGICAL TO HAVE MS CALL YOU and explain you about viruses, and then asking you to do things. MS will NEVER CALL you like this.
You call MS by yourself, if you have a Windows or Office problem AND you're from the IT department. If you have a problem and you're not from IT, don't call MS, call IT (they will call MS if necessary)!!!
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Agreed with kimputer.  There are companies that call *claiming* to represent Microsoft Support.  These companies do not represent Microsoft.
Avoid tech support phone scams

Cybercriminals don't just send fraudulent email messages and set up fake websites. They might also call you on the telephone and claim to be from Microsoft. They might offer to help solve your computer problems or sell you a software license. Once they have access to your computer, they can do the following:

◾Trick you into installing malicious software that could capture sensitive data, such as online banking user names and passwords. They might also then charge you to remove this software.

◾Convince you to visit legitimate websites (like www.ammyy.com) to download software that will allow them to take control of your computer remotely and adjust settings to leave your computer vulnerable.

◾Request credit card information so they can bill you for phony services.

◾Direct you to fraudulent websites and ask you to enter credit card and other personal or financial information there.

Neither Microsoft nor our partners make unsolicited phone calls (also known as cold calls) to charge you for computer security or software fixes.

If you need something to ease your brain on the NETSTAT subject.  Use the following netstat command in order to associate the connections with the processes that have the open connections:
netstat -aon

Open in new window

You should see something like this -Capture.JPGNow you can use task manager in order to associate the processes that have open connections.  For example:Here is a connection that I do not recognize, which process is using it?Oh it's Chrome.  That should be an IP address associated with something I am running in Chrome.  Looking up the IP shows it belongs to Google.Another common practice for these scammers is to use the Event Log to indicate MAJOR problems with your computer (no matter what the type of event message it is INFO, WARNING, ERROR).

Neogeo147IT Systems AdminAuthor Commented:
Thank you all for your help, I asked the user for the phone number he called and it ended up being a Non-MS number so I like I thought as you all did that it was all bull.
Don't just ask for the number, try to find out the how he got the number, and the reason why/what/where/when. Then according to this info (probably some flawed reasoning), try to warn the whole company where the flawed reasoning is and a step by step explanation what you should or shouldn't do.
It's not just one flawed reasoning in this case, but a whole range. Education is the best defense in most cases.

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now