Unsolved
This post is more than 5 years old
213 Posts
0
57101
Is the Dell Dock a Trojan program?
ZoneAlarm Pro notified me a few minutes ago that Dell Dock was requesting access to the internet.
Now, why would Dell Dock, that just sits there, and does nothing but hold shortcuts and macros for my computer's programs be trying to access the intranet?
Worse, what is it really sending?
There is no shortcut that I put in the dock that needs access to the internet/intranet, and there is no auto-checking for update feature either.
Something is very fishy here! Might explain the interruption when connecting to the internet, as that is where Dell Dock complains of errors when trying to load.
I have Stardocks's ObjectDock on my laptop, that has the Weather, and never gave any thought of not allowing it access to the internet. But now I am wondering what else is going on here, since Dell's version of the same program (without the Weather add-in) is trying to access the internet.
My desktop computer's Ethernet IP is 192.168.1.104, and the Wireless is 192.168.1.107, and Dell Dock wants out on 192.168.1.105 which is my laptop's IP address.
Sounds like a virus or Trojan activity going on here. The program should not be having the need to "reach out" to other computers connected in the home network
This might explain for the high internet activity I been seeing, and the numerous attempts at something in my computer trying to access other computers on the home network (which was also linked to freezing issues). We're talking serious numbers of attempts per day, over 100!
Description Dell Dock was temporarily blocked from connecting to the local zone (192.168.1.105).
Rating Medium
Date / Time 2009-07-01 17:55:28-6:00
Type Program Access
Program DellDock.exe
Source IP
Destination IP
Direction Outgoing (connect)
Action Taken Blocked
Count 2
Source DNS
Destination DNS
Policy Personal Policy
Now to await a reasonable, and accurate, reply as to why Dell Dock needs access to the internet. I have it blocked at the present times, and it's tried to connect to the internet/private network numerous times so far.
Might have to uninstall Dell Dock, this is too suspicious to dismiss
PudgyOne
9 Legend
9 Legend
•
30.3K Posts
0
July 1st, 2009 19:00
Xelkos,
I couldn't find an exception on my computer for Dell Dock but... I had an issue when I first got my computer and un-installed Dell Deck, then downloaded Dell Dock from Stardock. My wireless router uses ip address, so I don't even know what the ip address is on what you're seeing. I tried to compare my daughters ip addresses with mine looking for an identical one, since we both have Dell Dock installed.
I have run a full scan with FREE Avast Home Edition, Malwarebytes Anti-Malware, SuperAntiSpyware and Spybot Search & Destroy and they do NOT find anything. Did you try running full scans with your Virus protection and the above listed programs. If the above programs do find something, I would then suggest that you go to DELL Malware Removal Forum, read the top post by bugbatter and follow the instructions.
Rick
Xelkos
213 Posts
0
July 2nd, 2009 06:00
Trend Micro 2008 doesn't find any "known" critters. ZoneAlarm Pro notified me of the suspicious activity, which alerted me. Normally I would not think nothing of it, but I though it was odd that I got an alert since Dell Dock's been in place for a few months on this build.
Have a Russian Trojan scanner, not sure if it will function in a 64 bit OS. When this AV expires, will go Kapersky Labs.
As to why it's (NETBT) trying to contact my laptop computer (home network) over 100 times a day is worrying me. There is no reason for Dell Dock to be trying to access other computers on my network, let alone accessing anything on the internet.
Xelkos
213 Posts
0
July 2nd, 2009 07:00
192.168.1.100 = Router
192.168.1.101 = Network Printer
192.168.1.102 = Axim X50v (wi-fi)
192.168.1.104 = XPS 630i (wired)
192.168.1.107 = XPS 630i (wi-fi)
192.168.1.105 = Laptop #1 (wired)
192.168.1.10_ = Laptop #1 (wi-fi)
192.168.1.10_ = Laptop #2 (wi-fi)
192.168.1.10_ = Zune (wi-fi)
Dell Dock is using 192.168.1.104 (XPS 630i) to connect to 192.168.1.105 (laptop #1 wired). Why?
speedstep
9 Legend
9 Legend
•
47K Posts
0
July 2nd, 2009 07:00
192.168.1.105 is an RFC 1918 non routeable number. Numbers in that range would need to be translated via router to become public addresses.
RFC1918 - Address Allocation for Private Internets
Hosts within enterprises that use IP can be partitioned into three
categories:
Category 1: hosts that do not require access to hosts in other
enterprises or the Internet at large; hosts within
this category may use IP addresses that are
unambiguous within an enterprise, but may be
ambiguous between enterprises.
Category 2: hosts that need access to a limited set of outside
services (e.g., E-mail, FTP, netnews, remote login)
which can be handled by mediating gateways (e.g.,
application layer gateways). For many hosts in this
category an unrestricted external access (provided
via IP connectivity) may be unnecessary and even
undesirable for privacy/security reasons. Just like
hosts within the first category, such hosts may use
IP addresses that are unambiguous within an
enterprise, but may be ambiguous between
enterprises.
Category 3: hosts that need network layer access outside the
enterprise (provided via IP connectivity); hosts in
the last category require IP addresses that are
globally unambiguous.
We will refer to the hosts in the first and second categories as
"private". We will refer to the hosts in the third category as
"public".
The Internet Assigned Numbers Authority (IANA) has reserved the
following three blocks of the IP address space for private internets:
10.0.0.0 - 10.255.255.255 (10/8 prefix)
172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
192.168.0.0 - 192.168.255.255 (192.168/16 prefix)
PudgyOne
9 Legend
9 Legend
•
30.3K Posts
0
July 2nd, 2009 11:00
Xelkos,
My Dell Dock is not doing this. I have a Studio 1737 32-bit with Vista Home Premium. I actually monitor my network at all times using Linksys EasyLink Advisor and I soo no other connections that are out of place. When I'm home alone, I have no issues.
Did you scan for viruses and malware using the tools I mentioned above?
What type of security are you using in your wireless router?
Since you're using a network printer, I would suggest using...
WPA-PSK(TKIP) Security (Personal)
Update the firmware in your wireless router
Broadcast SSID (To make the connection easier, it may be easier to change the SSID name)
Mixed mode
Use channels 1, 6 or 11(I use channel 11)
Save and exit. power everything off for 30 seconds. turn everything back on and try to connect. Remember you'll need to setup your network printer and Zune, again.
Rick
You either have a security issue with your wireless router or malware. DELL Malware Removal Forum
Xelkos
213 Posts
0
July 2nd, 2009 14:00
I do see there is another version of Dell Dock out now, 15c. I was using 15b.
Will have to look at the update notes.
Xelkos
213 Posts
0
July 2nd, 2009 14:00
Rick,
Though I do appreciate your willingness to help me fix a router and network printer issue that I am not having, the discussion topic was why a shortcut-holding program is trying to connect to other computer in the network; not if it was actually succeeding, infecting, key-logging, or seeding.
Came here wanting to know why Dell Dock is trying to access another computer on my system. It's not getting through apparently, but it keeps trying, and I have running logs of its attempts. Key word there, attempts.
Scans are coming back with no "known" results. Still, there are alerts of suspicious activity. At this point uninstalling the program seems to be the cure for now. May try installing it again and see if the activity still wants to persist.
Xelkos
213 Posts
0
July 4th, 2009 05:00
15c really isn't 15c, it's 15b still. I had removed the previous Dell Dock, cleaned the registry, and after a few reboots and registry scans, I downloaded a new Dell Dock and installed that.
Dell Dock was behaving itself, till I switched back to Vista x64 just a few minutes ago.
ZAP hit me with an alert that DellDock.exe is trying to access the Internet. Okay... tell me again why a program that just holds shortcuts is trying to access the internet again?
It was trying to access 91.199.212.169:HTTP, and that brings up a white Opening window showing:
Which downloads an unusual file: IgiAAmvE.part @ 5 bytes in size, and stopping that download brings up yet another window: Visual C# Command Line Compiler has stopped working. Which further results in an error window:
And of course Dell Dock crashes.
Now, 5 byte in length, as claims to be a language file? Sounds more like a virus than a language file to me.
The previous attempt of GhLsMMxw.part results came back negative for critters, and at 5 byes too:
NotePad2 reads it as:
0
Scanned IgiAAmvE.part and no results came back.
NotePad2 reads it as:
0
I don't know what's going on either, and if not for ZoneAlarm, Pro notifying me I'm not sure what issues I'd end up with.
ZoneAlarm Pro's Log:
and..
and...
and....
This program seems to have more going on with it than a simple shortcut organizer.
Xelkos
213 Posts
0
July 4th, 2009 15:00
I also use Virus Total to selectively scan files remotely. No "known" hits are coming back, still doesn't discount the odd behavior of a shortcut organizer.
Why would it need to send out for file downloads from the internet after installation? Doesn't say that it has a self updating feature, after all, it just holds shortcuts - nothing else. Why does it need to go and download short files, and then compile them? What is it really trying to do? And when it's not allowed to do it, it wants to crash.
It is just supposed to holds shortcuts. By it's actions it is a Trojan, in that it's doing some other unknown activity while holding your shortcuts.
While it has no "known" virus hits, it is grabbing files on its own and compiling them.
I seen JavaScript run, grab files, compile, and start malicious activity and run viruses that did not exist in a simple harmless web page. Problem is with this, the infection source is not tagged and is free from virus/Trojan tags, yet it's still resident and keeps compiling. Thus the process keeps repeating while the web page was opened.
slikrick549
5 Posts
0
July 5th, 2009 02:00
Xelcos, try Googling the DNS address,ie: crl.comodoca.com, and see what you come up with. I think you are correct in assuming something fishy is going on.IIMHO, I would come up with a differrent dock alternative. I had a similar expierience while using the Dell Rescource Center program.Something was trying to call home somewhere, I ditched it , and now do my own drver,Bio's updates etc.Might be something harmless,but not worth the agrevation of knowing something is trying to do something under the table!Good Luck.P.S. I also ditched the windows for Linux,LOL.
Xelkos
213 Posts
0
July 5th, 2009 15:00
For a program that just holds & organizes shortcuts, I still can't see why it needs to connect to the internet.
It may be legitimate, yet this program is downloading files in 5 byte increments, and using the computer's files to compile - which gives more indication of a program readying it's payload, or building something that was not included into the original program. Which also gives an indication of even more suspicious of an unknown activity.
That's how virus' and malicious programs get into computer systems from seemingly innocent programs. A program gets in, starts downloading files, compiling, and releasing virus or other attacks. The initial program gets past the virus scanners cause it isn't a virus, but it will download and compile them on the host computer. That sort of infection is the worst to get rid of, and the affected user is best to rebuild from that point, as the program may have constructed other program to load and release their payload(s).
Not trying to say Dell Dock is malicious, but I am saying it's activities are associated to those of a Trojan program.
Essentially, Dell Dock holds a set of shortcuts and macros to facilitate the ability to launch programs from an easier to use GUI (Graphical User Interface). Such a program does not need to access the internet. It does not need to download files. It does not need to compile files that were not included in the original installation container.
Are there other program that are similar to the Dell Dock that are legitimate, and hold / organize shortcuts, in a pleasant GUI that can reside on the top portion of the desktop (with an auto-hide option)?
Xelkos
213 Posts
0
July 7th, 2009 13:00
Stardock refused to comment on the issue, saying to contact Dell.
lennyk325
1 Message
0
September 25th, 2009 09:00
Hay Xelkos, all IP address you posted go to a Comodo inc. which is (from what there site says) a security company that does internet security...could be fake or not. do you have any software that has come from this company...any SSL licences for secure email transfer or anything like that? if not, someone is using the exe to do bad to you. call Comodo and see what they say!!!