Task manager tries to connect to the internet Options

[pandy]

Why?

I've used TinyWall for several years, but haven't really looked at all the features. I found it can show all connections it has blocked the last 5 minutes. Taskmgr.exe has been blocked more than a hundred times - in 5 minutes. Why does it try to get out at all? Obviously it doesn't hurt anything that it's blocked, not that I've noticed anyway.

Note, TinyWall isn't a firewall in the usual sense. It sits on top Windows firewall and works by simply blocking all connections except those you OK. So when you first install it there's some fiddling. I think it's great, even if you have to remember to OK all new programs, but that's quickly done. I suppose it can be used as the only FW, but I keep the Windows one running. If anyone wants to try it, please note it doesn't work together with other firewall software, just the Windows one.

This is only the top of the list. You can see it's just 2 or 3 seconds between tries.



I don't know what the System process is about either. I didn't have to OK any system processes when I installed TinyWall, so it must have a built in whitelist.

[Christian J]

Maybe its telemetry, but the IP 91.92.240.95 (91.92.240.0 - 91.92.240.255) seems to belong to the (hosting?) company Limenet, not Microsoft.

Have you been running Task manager at these times? Is it possible to tell if it's running in the background (without using Task Managare itself)?

[pandy]

I don't know. But it's the same now and I don't have Task manager running.

Yeah, Limenet is odd. I don't know exactly what it is. But I found the IP is on some blacklists, seems connected to spam.
Can't link with query string, you need to paste the IP in: 91.92.240.95 .

https://whatismyipaddress.com/blacklist-check

[pandy]

I have 16 copies of taskmgr.exe. One of them is in a program directory which is maybe suspicious. Of course nothing stops people from naming their programs anything, but would a sensible person choose that name?

How many copies do you have? I expected to find just one!

I scanned the one in the program directory with Defender that didn't find anything wrong with it.

[Christian J]

I have 16 copies of taskmgr.exe. One of them is in a program directory which is maybe suspicious.

Which program's directory? Is that program trustworthy?

Of course nothing stops people from naming their programs anything, but would a sensible person choose that name?

Malware may disguise itself as wellknown programs.

How many copies do you have? I expected to find just one!

I only have one, in the Windows\System32 directory.

[pandy]

Which program's directory? Is that program trustworthy?

Yes, very.

Of course nothing stops people from naming their programs anything, but would a sensible person choose that name?

Malware may disguise itself as wellknown programs.

That's why I worry. At first I was just curious about what Task Manager was up to. But anyhow, TinyWall stops them from getting out.

How many copies do you have? I expected to find just one!

I only have one, in the Windows\System32 directory.

Attached a list of mine (except the big one). The big one had also placed itself in AppData\Roaming, so there are 12 others. They have different sizes and all are pretty new. I find that strange. The one in System32 is the real thing and should be as old as the computer. Then again, MS might have updated it, of course.

As you can see there are also a couple of taskmgr.exe-****.pf and I have 156 copies of taskmgr.exe.mui. At the bottom of the list there are 6 copies of taskmgr.exe.mun .

Anyway, I've found that the only one that tries to get out is the one in AppData\Roaming. I'll do some deleting and see what happens.

Sigh.

[pandy]

That went well.

[pandy]

On the Details tab in Task Manger I see 6 Taskmgr.exe processes. 1 is the real thing. All the others come form those two big files, the one in the program directory and the one in Roaming. So I guess it would be safe to kill those processes. I was unsure about if task manger showed itself, so to speak.

Here goes nothing.

[pandy]

Gaah! Now it couldn't be deleted because it was open in Windows Explorer.

So command line. No go!
"The process cannot access the file because it is being used by another process."

OK! UnLockIt fixed it. Both gone. I'll reboot and see if they come back again.

[pandy]

Nope. Didn't come back. But the mystery continues.

All the others are gone too from TinyWalls list of blocked programs. It only blocks two System processes now. Nothing else.
Still have 14 copies though.