[SOLVED] is there a malware on my pc or what??

[ilwa7esh]

am having a big problem here. when I booted my pc today and opened firefox something was consuming all my bandwidth. the network history was showing that i was constantly uploading about 70-80 KB/sec and downloading about 100 KB/sec. I wasnt running anything and it was a fresh boot. I installed wire shark and captured some data which i dont understand and cant post here because they are too much. If anyone can help me solve this problem plz? I wish to know what is happening? if there is a malware or something. I dont seem to be able to attach the wire shark file but i can email it to anyone who might want to help. I am running Ubuntu Gutsy.
Thank you in advance

edit:
Note: the only way to stop the upload was to set outbound policy to restrictive on firestarter and the re enable it after a few minutes... upload will then be stopped and will not resume

[stevejesus]

:confused::confused::confused::confused::confused:

[ilwa7esh]

anyone please?? i just came back to my pc to find it has uploaded about 360 MB data, I dont even know what it is uploading

Also I looked at the ip adresses on wire shark that my computer was connecting to and they all took me to google home page !!! is google accessing my computer and taking data??

edit
Ok i also installed darkstat and check this out:
Host IP- In- out- total
192.168.0.3- 33,274,688- 15,094,987- 48,369,675
192.168.0.1- 14,175,422- 11,096,439- 25,271,861

192.168.0.3is the ip assigned to me by the router and the other is the router ip so why is there so much data transfer between the two???

these are their values after I finished typing the sentence above
192.168.0.3 41,916,920 24,906,926 66,823,846
192.168.0.1 23,952,215 18,623,521 42,575,736


If you dont understand my post (my english is not that good) plz tell me and I will try to explain more. This problem is really disturbing for me because it takes my internet bandwidth and I am afraid that it might be a security vulnerability on my system.
Thank you in advance

[ilwa7esh]

Ok I think that all the stuff that is happening is between my pc and router (thats what i understood from the wireshark capture). So is this a problem with my usb wifi driver, or what?? Also what could be uploaded and downloaded between the router and my pc (no access to internet)? where would the router store the data its getting??(hundreds of megabytes).

Any opinions?

[xeth_delta]

Maybe "ntop" can give you some information on what the traffic is. You can find it in the repositories.

[ilwa7esh]

ok thx for the reply i will try it out and see what i can get, hope its easier to understand its data then wireshark

[ilwa7esh]

ok ntop is really great and easy to use :D, thank you for pointing it out.
what i found is same ( although ntop shows lots of other interesting stuff)
most traffic was happening between my pc and my router!! Does anyone know what this means?

[ilwa7esh]

Ok I have finally got what is causing the problem...It is firefox, I installed another web browser ( ice ape) and all the problems stopped. If i open fire fox and do a search on google for example my upload and download rates will jump to about 75 KB/sec each and continue like this until I close firefox. With the new browser this doesnt happen so I guess its firefox. so what should I do now? I dont want to uninstall firefox ( I like it and have many plugins installed which i dont want to looses) ? anyone had this problem with firefox before??

[xeth_delta]

ok ntop is really great and easy to use :D, thank you for pointing it out.
what i found is same ( although ntop shows lots of other interesting stuff)
most traffic was happening between my pc and my router!! Does anyone know what this means?

Great to hear you like it. Another program I haven't used for a long time, but which could be useful, is lsof. Though I don't exactly recall how to, it is possible to find out what program is usiing a certain port or file. You might then be able to pin-point which program is causing the increased traffic. Look it up in the forums and read the manual.

[EDIT] You already found out which program it was. What procedure did you use?

[ilwa7esh]

yeah It was firefox... the way i found out is just by noticing that every time i did a search on google using firefox, upload and download values jumped to 75 KB/sec (I was monitoring using system monitor and ntop). When I closed firefox the upload rate would go back to normal (0 KB/sec since i was doing nothing).
I tried other ways of accessing the internet (used bittorent, synaptic installer) but ntop did not show that weired thing of huge traffic between my pc and router. So thats how i got the idea that it could be firefox. So i tried another web browser and i have been using it without any problems. If I open firefox and do the same thing i am doing on this new browser the problem reoccurs, close firerfox and the problem goes. Thus firefox is the problem. Now is this a bug in firefox or caused by a plugin i downloaded I dont know.I dont understand what was happening between my router and pc, but it was for sure just between the 2 and all that traffic was not going to or coming from the internet ( ntop said it was a peer connection between my pc and router). The only thing i am sure is that it is related to firefox.
I would definitely like to understand what was happening and how to fix firefox without loosing my installed plugins (i dont want to reinstall them all again).

again thank you xeth_delta for your help

[ilwa7esh]

Ok problem solved :D , I just thought of checking the plug ins i have recently installed on firefox... there was one called "router status" ( i thought that it could be the one since it has to get info from the router) so i deactivated it and problem gone , reactivate it and problem reappears.
Now I will inform its author and rest :D

edit: sorry it is not a plug in its an extension for firefox

[xeth_delta]

Ok problem solved :D , I just thought of checking the plug ins i have recently installed on firefox... there was one called "router status" ( i thought that it could be the one since it has to get info from the router) so i deactivated it and problem gone , reactivate it and problem reappears.
Now I will inform its author and rest :D

edit: sorry it is not a plug in its an extension for firefox

Great! I wonder if that is supposed to be normal behaviour for the extension.

[ilwa7esh]

no it shouldnt do that, but i have a netgear router and thats partially supported so maybe it just doesnt work well with the router i have.