I've noticed in my task manager, an unclosable instance of server side Node.js running on my HP Laptop (running windows 10), after a little digging around I was wondering if it means I'm now unwillingly taking part in a botnet, and if so, if I can I trace the server it's coming from?
If you do have a process that starts automatically and that cannot be properly traced to a binary you installed or configured I would suspect malware alright. Just note that a complex OS like Windows 10 do have several ways of building a service, the most common way should be the
Startup directory (which has its own tab in the task manager).
Nevertheless, you should install Wireshark (or similar) and monitor the traffic of the machine in question. Although competent malware (e.g. rootkits) can hide itself from monitoring made on the same machine, your malware does not appear to be very good at hiding anyway.
(By monitoring traffic on an intermediate machine, e.g. a machine acting a s a router, you can even find traffic generated by well hidden malware.)
Monitoring the traffic you can show to what your machine is talking and (often) what is the content of the communication. Yet that does not really provide a solution to the problem of having malware (for that see: Help! My home PC has been infected by a virus! What do I do now?)
Extra note: I'll repeat again, check first all the system services. Notable the
Startup tab. Installers of a good deal of software today do install a Node instance, and make it run on startup.
For those who suspect the Node.Js, it's something Adobe uses. You can check where this process is originating from by right-clicking the process > Properties. You will then see the path of the process...
Just got into the same issue but right click -> properties showed me it's just Prey disguising itself as Node.js so not an actual problem in my case