1

So I was looking at my cmd.exe > netstat -ano and I noticed that there were two PID's (4472)(9032) that had the same IP address that was showing as established. When I went to compare the PIDs to the task manager, there is no such thing as PID 4472 or 9032.

I'm trying to find out how to delete or terminate these because I believe my computer might be hacked. Whenever I try netstat -b or -o, it doesn't show any programs or things open with those PIDS. so I can't even try to delete the /im or anything.

Any ideas on how to fix this problem?

Improve this question
2
  • If its hacked, that is why it does not show in task manager, back up critical data and do a clean install of the OS.
    – Moab
    Jul 12, 2020 at 1:21
  • If you download Procdump - docs.microsoft.com/en-us/sysinternals/downloads/procdump and then run procdump -ma 4472 and procdump -ma 9032 does it also say they are not there or does it create dumps for the process? The dumps if created would be useful. If that doesn't help and netstat still shows the PID, I'd probably run Process Explorer or Process Hacker to confirm they don't see it, maybe TCPView. If no, then LiveKd+Windbg and take a look at the list of processes the kernel think exists.
    – HelpingHand
    Jul 12, 2020 at 8:57

1 Answer 1

Reset to default
0

For the part of the question How to terminate the PID, simply use taskkill. My advice - copy the IP address and search IP details on google. You will get the location and the owner. From there, you can conclude if there some country like Russia(as an example) there is a problem. Otherwise, there are a lot of process like windows checking if WiFi has internet access, some program checking updates. Check This - Stack Overflow

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .