You are not logged in.
I have been facing a weird error and I am not entirely sure if it is arch related or not. Whenever I search for something on google, I am taken to a captcha page to verify that I am not a robot.
A typical captcha page with the following text under the submit button
"Our systems have detected unusual traffic from your computer network. This page checks..."
Has anyone else experienced anything like this? And if my understanding is correct, someone who is using the network likely has a virus or something of the sort(not necessarily me correct?).
After using clamav to scan my computer for any viruses it came up with
/bin/openal-info: Unix.Trojan.Vali-6606621-0 FOUNDCould this be the cause?
Last edited by jbenge1 (2018-07-16 13:43:57)
"Dr. Madden, why don't the natural numbers include 0?" -me
"....... Take a philosophy course" -Dr. Madden
Offline
Tried "pkgfile /bin/openal-info", does not belong to an Arch package.
You should "pacman -Qo /bin/openal-info" to see what AUR package you've installed to pull this in, verify, that it has been built cleanly and then report this in the AUR package site and the mailing list.
Offline
netstat -tpAlternatively run wireshark.
google does this if you bang their servers w/ requests - rogue network status indicators tend to do such.
(Yes, could also be malware, but malware usually tries to go stealth mode)
Offline
If you still connect with an IPv4, you might also be unlucky and share your IP with too many other users that access google.
| alias CUTF='LANG=en_XX.UTF-8@POSIX ' | alias ENGLISH='LANG=C.UTF-8 ' |
Offline
pacman reports the owner of /bin/openal-info is openal
/bin/openal-info is owned by openal 1.18.2-2I couldn't find any packages from the AUR that would require this the only ones I have pulled and built are google-chrome and kaku...
netstat -tpAlternatively run wireshark.
google does this if you bang their servers w/ requests - rogue network status indicators tend to do such.
(Yes, could also be malware, but malware usually tries to go stealth mode)
I'm not entirely sure what I should be looking for in the output if you could give me a few pointers? Also here is the actual output
$ss -tp
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 192.168.4.130:42100 198.252.206.25:https users:(("firefox",pid=12792,fd=152))
ESTAB 0 0 192.168.4.130:44502 74.125.133.189:https users:(("firefox",pid=12792,fd=123))
ESTAB 0 0 192.168.4.130:48220 216.58.205.46:https users:(("firefox",pid=12792,fd=126))
ESTAB 0 0 192.168.4.130:59900 216.58.205.35:https users:(("firefox",pid=12792,fd=178))
ESTAB 0 0 192.168.4.130:39206 34.214.201.8:https users:(("firefox",pid=12792,fd=161)) "Dr. Madden, why don't the natural numbers include 0?" -me
"....... Take a philosophy course" -Dr. Madden
Offline
Currently only firefox holds 3 tcp connections to google (74.125.133.189, 216.58.205.46 & 216.58.205.35) - that's not suspicious, but you've to look at the connections more often to see whether something "odd" pops up (google will captcha you for some hours after an "attack")
Reg. post #4: You're "192.168.4.130" - are you maybe behind a NAT in a bigger LAN (company, university pool, …)?
Offline
yes a company
"Dr. Madden, why don't the natural numbers include 0?" -me
"....... Take a philosophy course" -Dr. Madden
Offline
Doesn't have to be you at all, sombody™ else could bug google. The entire subnet will be affected.
Talk to your IT, they can isolate the system w/ overly many requests to google.
Offline
turns out, it was in fact someone else on the network....
"Dr. Madden, why don't the natural numbers include 0?" -me
"....... Take a philosophy course" -Dr. Madden
Offline