Member Avatar for quintabelina

Just moved and the cable/internet guy told me I have a nasty trojan called "deploy.akamaitechnologies"..... said he'd seen them before and they were very hard to get rid of, I've looked online and found many posts from people with this problem yet no concrete solutions, I need help taking if off my computer, please!

  • 2 Contributors
  • 3 Replies
  • 427 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by PhilliePhan

Dani AI

Generated

— brief clarification and practical next steps (adds to ’s point).

Short answer: the hostname deploy.akamaitechnologies.com is normally an Akamai CDN endpoint used to deliver files and updates for many vendors, so seeing that FQDN in network output is not by itself proof of a trojan. Akamai runs edge servers around the world and the same CDN name can resolve to many IPs. ()

Quick, reliable checks (ordered and repeatable):

  • Identify the connection and owning process: run netstat -ano (or netstat -b as admin) to get the PID and remote host. Match the PID in Task Manager (Details) or with tasklist /SVC. These commands reveal which executable or service opened the connection. (learn.microsoft.com)
  • Inspect the executable: use Process Explorer (Sysinternals) to show the process image path, command line, publisher signature and loaded modules; unsigned or oddly located EXEs are suspicious. (en.wikipedia.org)
  • Check runtime activity: Resource Monitor (Network tab) shows bytes sent/received and remote endpoints per process; Autoruns (Sysinternals) reveals persistence (services, scheduled tasks, startup). Use VirusTotal or a domain/file reputation service to check any unknown file or domain before deleting. (techrepublic.com)

Blocking and removal notes:

  • Blocking the hostname by hosts file is brittle (hosts does not support wildcards) and blocking Akamai IP ranges is likely to break legitimate updates and many sites because the CDN uses many anycast IPs. Investigate the process first; removal should target a malicious binary or autorun entry, not the CDN name itself. (unix.stackexchange.com)

If a binary is confirmed malicious, use an offline/bootable scanner (Microsoft Defender Offline or a reputable rescue ISO) to clean the system before re-enabling network services; keep backups and avoid terminating critical svchost.exe instances blindly. (microsoft.com)

Summary: the hostname alone usually indicates CDN traffic; the correct approach is to identify the process making the connection, inspect its path/signature/persistence, and then remove any malicious binary or autorun entry with offline tools if necessary.

Recommended Answers

All 3 Replies

Member Avatar for PhilliePhan

Just moved and the cable/internet guy told me I have a nasty trojan called "deploy.akamaitechnologies"..... said he'd seen them before and they were very hard to get rid of, I've looked online and found many posts from people with this problem yet no concrete solutions, I need help taking if off my computer, please!

To my knowledge, Akamai is not a baddie.
They are a large content provider / server system. Many legit companies use them ( and some not-so-legit, as well ). I don't think there is anything to worry about here.

If it really bothers you, you could run the tools in the linky below and post the scanlogs:

http://www.daniweb.com/forums/thread134865.html

Cheers :)
PP

Member Avatar for quintabelina

Really? Wow, he spooked me, telling me that this was the cause if my computer slowed down and that it was really a nasty one. That I should look online at once and get instructions of how to erase or my computer's performance would degrade over time.
So you say it's harmless? No need to worry, right?

Member Avatar for PhilliePhan

So you say it's harmless? No need to worry, right?

As far as I know, they are simply very very very large third party content provider. It is quite possible that they could host a baddie now and then, but I wouldn't worry too much.

If your compy has been erratic of late, run the tools in the linky I posted - At the very least MBAM and DDS and post those for us and we'll have a look.

PP:)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.