This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have been looking at packets on my network a lot lately and I found out some crazy things. One is that most of the laptops sold today come with a windows/osx BIOS loading trojan called computrace, lojack. It has the purported intention of tracking stolen laptops but is easily exploited into very persistent trojan that can load into windows/osx and now linux too. Suffice it to say I trust nothing but the wire and a USB booted laptop to further analyze what all this stuff is on my network.

Ok, so, one of these laptops runs windows 7 and def has the rpcnet.exe lojack software as I have seen it contacting Absolute Software here and there. The laptop is not stolen so I wonder why on earth it does that. Anyway, it also exhibits the following behavior upon waking from hibernation. Please see the screenshot,

http://i.imgur.com/CIkVg.png

Any idea why it would look up random NB names?

Any and all expertise is appreciated. Considering going out to Stanford for the Sharkfest.

asked 03 Jun '12, 13:07

pluribus's gravatar image

pluribus
1446
accept rate: 0%

I may have answered my own question from the LLMNR RFC

Seems random lookups are part of the spec. Any experts welcome to chime in.

http://www.ietf.org/rfc/rfc4795.txt

(03 Jun '12, 13:45) pluribus

Maybe somebody else can shark the wire with windows 7 and let me know?

Thanks,

P

(03 Jun '12, 13:50) pluribus
1

"Any and all expertise is appreciated. Considering going out to Stanford for the Sharkfest."

I wouldn't go to Standford if I were you...

... we're having Sharkfest in Berkeley this year ;-)

(03 Jun '12, 14:09) SYN-bit ♦♦
1

As displayed here: SharkFest '12

(03 Jun '12, 14:18) grahamb ♦

Whoops, my mistake. Brain switch.

(03 Jun '12, 14:38) pluribus

Kindly disable Netbios over TCP/IP on your Lan connections.You wont see any NBNS broadcast

permanent link

answered 07 Jun '12, 22:29

bluebird77's gravatar image

bluebird77
1112
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×254
×36
×27
×12
×5

question asked: 03 Jun '12, 13:07

question was seen: 5,525 times

last updated: 07 Jun '12, 22:29

p​o​w​e​r​e​d by O​S​Q​A