Analyzing Sysinternals TCPView

  • Thread starter Thread starter the K
  • Start date Start date
T

the K

I suspect there is malware on my machine because of spikes of up to 100% CPU
usage. I have Eset's Nod 32 antivirus software and one of it's files,
ekrn.exe looks suspicious. I downloaded Sysinternal's TCPView, but there's
not much documentation on it and I'm not network savvy.

To begin with, what do the various connection states aside from Establisthed
mean in TCPView?

I see one connection where the remote address is localhost:1081. What type
of connection does that represent?

Here's the suspicious part, the ekrn.exe process has established connections
with websites I'm not aware of after clicking Whois on that row. Furthermore,
when I closed one of the connections, 8 ekrn.exe rows appeared with
Establisthed connections, some of which display errors when I click Whois.
From what I've explained, would you think that this process has been hacked
to accomodate malware?
 
the said:
I suspect there is malware on my machine because of spikes of up to
100% CPU usage. I have Eset's Nod 32 antivirus software and one of
it's files, ekrn.exe looks suspicious. I downloaded Sysinternal's
TCPView, but there's not much documentation on it and I'm not network
savvy.

To begin with, what do the various connection states aside from
Establisthed mean in TCPView?

I see one connection where the remote address is localhost:1081. What
type of connection does that represent?

Here's the suspicious part, the ekrn.exe process has established
connections with websites I'm not aware of after clicking Whois on
that row. Furthermore, when I closed one of the connections, 8
ekrn.exe rows appeared with Establisthed connections, some of which
display errors when I click Whois. From what I've explained, would
you think that this process has been hacked to accomodate malware?
Click to expand...

The file itself seems to be OK but a Google search reveals a LOT of
people with your same problem. I'd recommend looking thu some of those.
Here's just one I picked at random:
http://forums.techguy.org/general-security/729924-some-questions-about-ekrn-exe.html

I didn't dig into it because it was so easy to find, but you should,
since it's so widespread a problem.

Cheers,

Twayne
 
Back
Top