1

Some assistance/advice needed to research this.

First: I am not sure if this is the right place to ask this. If it isn't please note and I'll close.

Over the weekend my email accounts (yahoo & corporate) were locked because of invalid password.

Looking at one of my laptops (Windows XPSP3), using ProcessHacker.exe I see the process "ntkrnlpa.exe" connected to IP 205.202.182.4. Further looking up that IP points me to:

uk uk lnd london 51.514999 -0.083000 dinsa ministry of defence

What other tool would someone use to inspect this?

Edit: I added some screen shots.

Screenshot1_ProcessHacker

Screenshot2_ProcessHacker

Improve this question
3
  • 2
    odd the whois I did on that IP address points to University of Nebraska... per en.wikipedia.org/wiki/Ntoskrnl this is a core windows component.
    – Rory McCune
    Dec 16, 2013 at 17:15
  • @RoryMcCune Besides that you can simply spoof executable names, I wouldn't trust a potentially compromised machine to produce any reliable information about what's running.
    – Luc
    Dec 16, 2013 at 19:38
  • @Luc indeed I wasn't intending to suggest that the name implied trustworthiness, more that this was a known process and may well have reason to make outbound connections.
    – Rory McCune
    Dec 16, 2013 at 19:41

1 Answer 1

Reset to default
1

You should first investigate the IP and block further. If you do a reverse lookup, just typing nslookup 205.202.182.4 into a command line, you'll see:

Name:    mil_shs_4.mil.esu3.k12.ne.us
Address:  205.202.182.4

Looking the subnet up in ARIN it's owned by the university of Nebraska, but the address looks like it belongs to an elementary school. So, nothing to do with the UK MoD.

So does this help you? Maybe, if you have nothing to do with a school at Murdock, Nebraska then one of their servers may be owned, and is being used as a C&C server for malware on your computer. If your system is connecting to this often then it's quite possible you've been hacked. Whether that is why your email accounts were locked is a different story, but it's reasonably likely.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .