7

While using an open port checking tool (Technicians toolbox v1.1.0) I found a strange user name listening on port 139 hiding in PID 4 with a mix of Chinese and other Unicode characters as the user name:

There is no command line or creation date or an executable path or device path listed. Also the program won't let me trace the file path; it comes up with "Error". In Windows Task Manager, PID 4 shows as "System".

The Unicode characters are:

U+548B U+0824 U+428D U+8B0C U+E84A U+C833
U+ACE8 U+F8A9 U+B8FF U+F680 U+7318 U+29E9
U+FBBA U+22FF U+9305 U+0219 U+005C

The Google translator translated the Chinese portion as "Ye Ge mad dog" mixed with some form of Unicode.

According to unicode-table.com there is a mix of Arabic, Korean, Japanese, Latin and Chinese with private code blocks mixes throughout.

I am running my laptop through a Belkin 600 wifi range extender boosting off of a Linksys WRT54GS, both have no security.

Does anyone have any idea what this is? Should I kill this process?

  • 1
    More to investigate: does the port checking tool also give you the IP address of the client that is connected? If not, then what does something like netstat -aon | find "139" give you? Given that IP address, a whois might give you some clue about where they're connecting from, assuming it's not an address in the private ranges for local networks. Also, are you saying your WiFi is not protected? Then it could even be a neighbour (possibly with an infected computer) that is connecting. – Arjan Aug 3 '15 at 11:40
  • 1
    Ah, my bad: I thought you somehow saw the username of whoever connected, but it's the user name of the Windows process. Then netstat -aon | find "139" can tell you if anyone is (currently) connected. The very low PID indicates that this is started at a very early stage when Windows is started, I think, but I'm not using Windows so I'm not 100% sure about that. Can you see the same weird user in the list of Windows users, somewhere in Control Panel? Also: the standard Windows Task Manager can show the PIDs too; maybe you can tell which program is related to that then? – Arjan Aug 3 '15 at 12:17
  • 1
    @Arjan No the Pid just list 4 as system along with a host of other process that run under system. And even with the tool I am using I am still unable to trace the file path. I'm at my the end of my know how on this. No other process has the user name written in Unicode on that tool I am using. I am trying to track the file path looking for a browser hijacking virus that slipped in with a game that was downloaded onto the family laptop. So far it's only been hijacking chromium based browsers Opera, Comodo and Google Chrome. Mozilla and IE finally got hit to now I'm using Slim Browser. – Joe Brown Aug 3 '15 at 12:48
  • 1
    Just FYI: in Windows 7 running in Parallels on a Mac, I see user name SYSTEM in Windows Task Manager. And netstat -aon | find "139" also happens to show PID 4 just like for you, and netstat -abon shows many hits for that PID 4, but also shows no executable for any of those. Like for port 139: TCP 10.211.55.5:139 0.0.0.0:0 LISTENING 4 Can not obtain ownership information. – Arjan Aug 3 '15 at 12:55
  • 1
    Ah, beware: in Task Manager you should see Image Name = System and User = SYSTEM, so make sure to use menu "View" to enable columns if needed. On Windows 7, I see this, including Image Path = C:\Windows\system32\ntoskrnl.exe, but no value for Command Line. – Arjan Aug 3 '15 at 13:06
2

Check the process with another tool such as TCPView from Microsoft. It will show process names with ports open with PID, protocol, local address, local port, remote address, remote port, as well as sent and received packets and bytes for each entry. Look for process ID 4 in its list. When you have located it, if you double-click on an entry, or right-click and choose "Process Properties", it will show the path and file name associated with the process. You could upload the file to Google's VirusTotal site, which checks uploaded files with multiple antivirus programs, to check whether it might be a system file that was replaced by malware, though it is possible that what you are seeing is due to some quirk of the tool. Once you have the location of the file associated with the process, you could right-click on it in the Microsoft Windows Explorer, choose "Properties", then select "Digital Signatures"; if it is a legitimate program, the name of the signer should be "Microsoft Corporation".

Another free tool that provides functionality similar to TCPView, is CurrPorts from NirSoft.

  • Thank you I am all ready running TCP and a few other Sysinternal programs but with no listed IP and the pid 4 "System" which runs a host of programs in windows I have to start up every program linked with the system process and pause TCP and back trace hundreds of IP addresses which I did and was able to close the open port but not trace the infected file. The "Oops something went wrong" BSOD was taking over the windows startup and I traced it to 4 countries on multiple IP's. – Joe Brown Aug 3 '15 at 13:06
  • Oh well, @Joe, if the computer doesn't even start okay, then that probably explains the weird user name too, right? I'd just wipe everything. – Arjan Aug 3 '15 at 16:03
  • @Joe Brown, if you are using other Sysinternals programs, Autoruns has sometimes helped me identify illegitimate programs being run when the system starts. I've listed other free tools for identifying malware here which I use. – moonpoint Aug 3 '15 at 16:23
  • The computer starts just fine now I restored it back to factory condition and ran half a dozen trusted cleaning spyware and malware programs that were loaded on a flash drive and each of those was checked against one another before I loaded them onto the computer which was completely disconnected from my network or any internet connection. I found this string after all of that and now the same Unicode string has moved to PID 0 and 4. @moonpoint might be right about a glitch in the process checking program but it works fine on the other process's I have checked it with. – Joe Brown Aug 3 '15 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.