MCYSEKA-Maritime Cyber Security Knowledge Archive

Hello everybody!

I’m a software developer with tiny understanding in networks.

Few months ago I entered a gaming site which is called – slither.io which runs on http port 80.

Since then (after months) every time when I reset my laptop and then run the command “netstat” I see connection established to foreign address “slither:<high port>” sometimes its 19200 and sometimes its 49800 (but it’s always high ports – not the first 1024 ones).

​

Whenever I run the command “netstat -ano” I can see the process (PID) that runs/is connected to this established connection – which is always something like 6620 or 7208 etc… when I got to the task manager under details, I see that it is always connected to mysqld.exe process (which is really installed on my computer for software development reasons).

Whenever I “end task” of this PID – the established connections are gone. but whenever I reset my laptop – the established connections to slither.io are back with different ports and different PID.

I tried to add slither.io into my hosts file in system/etc – and it really blocked it (and I cannot reach out to it through the browser or http request) but it is still keep on coming back and appearing in my netstat results screen. I wonder what kind of virus / trolling act could it be ?

Be glad to get some help how to remove those established connections to my laptop whenever I reset and open it.

​

​

netstat command

​

​

netstat -ano command (where i can see PID 7208)

​

​

MYSQLD.EXE PID 7208 connected to this established connection of slither.