My home ip address is blacklisted on http://cbl.abuseat.org/lookup.cgi?ip=63.142.130.18&.pubmit=Lookup and they state that a workstation in my home is infected with the ZeuS trojan, also known as "Zbot" and "WSNPoem" I delisted my ip address but am back on the list, which affects my email deliverability. I have spent all morning trying to use Wireshark to sniff the traffic on my entire network looking for the workstation that is communicating with the external ip address that they have identified the information is being sent to, although in this case it is a sinkhole. I have tried multiple filters and command strings but nothing seems to be working the way I envisioned it would. Does anyone know where there might be a step-by-step guide for what I am attempting to do? I am in school for IT and have years of experience on computers. The common homeowner would be bald by now. Thanks PS - I am using a Mac and wonder if this program would work better on a PC? asked 26 Sep '13, 09:46  billwynne edited 26 Sep '13, 09:48 |
2 Answers:
hm.. they tell you pretty clearly what to look for. Cite: That's not a guarantee to find the machine, as it may have switched to a different C&C server, but did you try all that? Regards answered 26 Sep '13, 10:35  Kurt Knochner ♦ edited 26 Sep '13, 10:37 |
To filter on traffic to and from the sink hole, enter the following display filter: ip.addr==87.255.51.229 Assuming, as is likely, that you're on a switched network, the problem may be that you're not seeing the traffic from the infected machine. See this page of the Wireshark Wiki for a discussion of how to capture traffic on a switched Ethernet network. answered 26 Sep '13, 10:50  Jim Aragon |
Hi Kurt, Thanks for taking the time to share. I have run Wireshark to view all the network traffic and then looked for that ip address and port but it did not show up at all. I have all the workstations running so I could bust the culprit. I am not sure that I am using WireShark the right way to do this.
It is a technical piece of software and I was hoping for a step-by-step guide on how to perform a task like what I am trying to do.
Thanks
O.K. where did you run Wireshark? On your local PC? If so, you will not see the whole network traffic unless you've taken the appropriate steps.
Please check that.
O.K. if your capture setup is done right (see above) and you still don't find that IP address, you could look for 'strange' DNS names. Trojans often use random domain names for their C&C servers (like the one mentioned: benznflvsgttdydqdguwcem.info). So, please capture the whole DNS traffic and then filter for DNS requests.
Display filter:
Try to find strange looking names like the one above.