Strange Device that I don't recognize appears in my Network at boot-up

stois2121 · 29 Mar 2016

Hello,

When my computer starts I notice in the Network that shows the devices in my home network a strange device named: : p3plcpnl0481.prod.phx3.secureserver.net@SSL@2078. This device appears next to my PC and after a while it dissapears.

I searched online for this hostname and it shows me a remote server. I have no idea why this is happening and for how long it has been there. I am worried that maybe my computer is compromised?

I would be grateful for any advice on how to find out what this device is and how to stop this from happening.

ICIT2LOL · 30 Mar 2016

Hello and welcome stois first some system specs please very hard to work with something we know virtually nothing about System Info - See Your System Specs

Now for starters please run these
SFC /SCANNOW Command - System File Checker
Disk Check < if necessary include the /f and /r in the command line as per Option2 < in safe mode

if no change then try these

SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
Malwarebytes | Malwarebytes Anti-Malware Premium
AdwCleaner Download
ADW download from bleeping computer delete any rubbish found with the malware scans
NB If anyone who has Kaspersky as their security they may find it will not like ADW running and to stop the nagging just temporarily disbale the Kaspersky while one runs ADW

If these come up with nothing then run this Kaspersky Rescue Disk 10
you will need to make a bootable disk and this scan does not involve Windows which is a good thing.

stois2121 · 07 Apr 2016

Hello ICIT2LOL,

I have updated the system information and I have run the system file checker and disk check, no problems were reported. I then used the spyware and malware removal programs you suggested and they identified some suspicious files that I removed but that did not resolve the issue.

Below, I post a screenshot of the device in order to understand exactly what I am referring to:

I still see the above device when I start the PC. I searched online and the hostanme p3plcpnl0481.prod.phx3.secureserver.net has an IP of 50.62.176.8. Thus, I openned wireshark as soon as windows started and I captured some traffic. Whithin the captured traffic I see that a TCP connection is established between my PC and the remote IP 50.62.176.8, some packets are exchanged and then it is terminated.

However, I cannot understand how this happens and how to stop it.

torchwood · 07 Apr 2016

Hi Stois,
thats primarily an email server, do you use a third party one, it appears and dissappears because its checking for new mail.

Roy

stois2121 · 07 Apr 2016

Hello Roy,

Thank you for your reply. As far as I know I do not... The only email I use is personal one that I log in from a browser.

Can you please explain a bit more what this means and how I can investigate it more?

torchwood · 07 Apr 2016

Stois,
You said i use my own one,
which one Outlook/gmail/thunderbird/ there are lots more.

Roy

ICIT2LOL · 07 Apr 2016

Yes mate as torchwood has said I too use a dedicated email server WLM not a web based one like I think you are referring to and mine does get laggy at times.

stois2121 · 08 Apr 2016

By my own I am referring to gmail, I do not use any external email servers. If it is indeed an email server it is very strange that it appears.

torchwood · 08 Apr 2016

Hi Stois,
When this first appeared had you installed any new program.
Its possible that you also picked-up an add-on at the same time. (foist ware)

Roy

ICIT2LOL · 08 Apr 2016

Its possible that you also picked-up an add-on at the same time

Good point and stois one way to avoid that sort of crap for the main part is this https://unchecky.com/ I have it on all my machines.