1

Some assistance/advice needed to research this.

First: I am not sure if this is the right place to ask this. If it isn't please note and I'll close.

Over the weekend my email accounts (yahoo & corporate) were locked because of invalid password.

Looking at one of my laptops (Windows XPSP3), using ProcessHacker.exe I see the process "ntkrnlpa.exe" connected to IP 205.202.182.4. Further looking up that IP points me to:

uk uk lnd london 51.514999 -0.083000 dinsa ministry of defence

What other tool would someone use to inspect this?

Edit: I added some screen shots.

Screenshot1_ProcessHacker

Screenshot2_ProcessHacker

  • 2
    odd the whois I did on that IP address points to University of Nebraska... per en.wikipedia.org/wiki/Ntoskrnl this is a core windows component. – Rоry McCune Dec 16 '13 at 17:15
  • @RoryMcCune Besides that you can simply spoof executable names, I wouldn't trust a potentially compromised machine to produce any reliable information about what's running. – Luc Dec 16 '13 at 19:38
  • @Luc indeed I wasn't intending to suggest that the name implied trustworthiness, more that this was a known process and may well have reason to make outbound connections. – Rоry McCune Dec 16 '13 at 19:41
1

You should first investigate the IP and block further. If you do a reverse lookup, just typing nslookup 205.202.182.4 into a command line, you'll see:

Name:    mil_shs_4.mil.esu3.k12.ne.us
Address:  205.202.182.4 

Looking the subnet up in ARIN it's owned by the university of Nebraska, but the address looks like it belongs to an elementary school. So, nothing to do with the UK MoD.

So does this help you? Maybe, if you have nothing to do with a school at Murdock, Nebraska then one of their servers may be owned, and is being used as a C&C server for malware on your computer. If your system is connecting to this often then it's quite possible you've been hacked. Whether that is why your email accounts were locked is a different story, but it's reasonably likely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.