taskmgr.exe is asking permission to connect to 220.127.116.11.
I am using windows 7. Is it normal? Is my machine infected with malware? Thank you!
When doing a google for
Now let's do some whois to see who these guys are:
Seems Markmonitor protects a brand, which less likely indicates an odd malicious IP.
But there's also
Again a brand being protected.
Doing a reverse IP gives
Notice anything? Exactly, covered by the same registrant which might link all three together.
What are we missing? Right, visiting the domain names to see what they host.
http://www.rr.com (Road Runner) seems like a completely safe site, which is associated with Time Warner Cable as stated at the bottom (Perhaps related to TVC?) which also seems like a completely safe site.
I've found that
Go to this online
This makes the
But why would taskmgr.exe try to connect to it?
Do you remember visiting Road Runner or Time Warner Cable, or are you an user of their services?
I see no other possibility than that, given that these last websites look safe. And clearly the IP is a DNS for their DNS Search functionality. It could be possible though, that they have an infection and that it spread to you; but I wouldn't be so certain at first...
Can you post us the output of
If you are completely not using any of these services, malware is most likely using that website to resolve things; meaning to bypass your hosts file / own DNS settings.
Named host is involved in massive abuse and present in most global blacklists. So you have a backdoor.
Use a clean computer to record a CD with:
If you are directly connected to internet with a Windows computer you might want a NAT home router.
I quite positive that you're dealing with a worm or a trojan horse.
Try downloading Malwarebytes Anti-Malware Free, install it, boot in Safe Mode and scan your system.
Actually, it isn't malware, just a service provided by RoadRunner/Bright House/TWC called "RoadRunner Search Guide".
Just go to http://dnssearch.rr.com, and you will see a link for "Opt in or Opt Out of this Service".
Under "Web Address Error Redirect Service" select "Disable"
This will opt you out, and give you back your usual DNS functions.
Also at http://dnssearch.rr.com, you will see a link for "Why am I here?"
I spent an evening trying to figure out why a friend kept getting nslookups for www sites for 18.104.22.168 and 22.214.171.124, but not for domain lookups. It looked enough like China's "Golden Shield" that I began to suspect the ISP.
Personally, I feel that they should have been a little more obvious about what they were doing. But that is just my opinion.
It is http://silkroad6ownowfk.onion Black market website. It will steal your info.