TCPView confusing and mysterious new 'user' appeared

[ona_to_zna]

Hello everyone, I need some explaining

 

First, I must mention that one of your experts has only just finished helping me with a different issue, MrCharlie. 

Second, I don't know that this IS a problem, so this is why I'm starting a new topic - I need someone who knows what it all means, and explain it to me, so that if it's nothing to worry about, I won't panic for no reason. 

 

During the work with MrC, he suggested downloading TCPView, because MalwareBytes Anti-Malware keeps showing me a text bubble for blocking IP addresses - I don't know whether they are false positives or something else, and once I've read the thread on IP blocking, that stopped being my concern. But after opening TCPView, although I was on Google Chrome at the time with only three opened tabs, one for Google.com, and two for your forum's topics, TCPView showed that there were more than ten processes related to Google Chrome, all with different remote addresses, all 'ESTABLISHED'. The numbers change - even though Google Chrome was open all the time, sometimes there were no processes related to Google Chrome whatsoever, other times there were more than 20.

So, I'm hoping that there is someone who can tell me what that means, is it cause for alarm or not. 

 

Another thing I'm wondering about is, what the appearance of the new 'user' means in C:\Users\? As far as I remember, there used to be only two... Now there are three. The third folder is named 'Updatususer', which is apparently entirely empty, even though the 'properties' say its about 50MB. But, inside, in the 'desktop' folder is the icon for PhotoScape, a program that I know I have on my computer. So, is this a problem, or not? Can programs create 'users'? Who can? At first I was 100% sure that there were only two. Now I'm beginning to doubt myself.

 

And, lastly, the most important thing is to mention that I am a computer 'dummy'. I need everything broken down as much as possible, because otherwise I won't understand any of it.

 

If there is someone who can enlighten this 'dummy', I would be eternally grateful.

 

 

[David H. Lipman]

Screen capture would help...

[ona_to_zna]

Well, if I knew what to do with it, maybe... 

[ona_to_zna]

All right - so I found what 'Updatususer' is, so that is no longer an issue. Still not clear on what the TCPView is showing though, and what it means. 

[David H. Lipman]

TCPView is a program that shows what software is loading a service opening a TCP/UDP port in IPv4 or IPv6 space or showing what program is connecting to what Internet or Intranet site using what TCP or UDP port in IPv4 or IPv6 space.

 

In the following example it shows that Firefox on my PC (Orange-PC) is connected to multiple sites via HTTPS (TCP port 443)

 

[ona_to_zna]

Ok, so, if the local address column (a bunch of zeros, and sometimes scrambled numbers to me) is not all identical numbers like yours is all orange-pc, is that a problem?

Secondly, and this was the part that looked odd to me - if your browser is open, and only three tabs are opened, like I've mentioned above - should there be so many processes related to the same browser? (In my case, Google Chrome, 3 open tabs, but TCPView shows none, or more than 10, even 20 processes for Google Chrome - changing all the time - even though at the time Google Chrome was minimized, and I wasn't doing anything on the computer except stare at the TCPView trying to figure out what it all means).

[David H. Lipman]

Please don't compare Apples to Orange-PC (that's a joke).

 

But seriously you can't compare what you see to what I have.  I merely posted that as an EXAMPLE showing Firefox making a TCP/IP connection.

[ona_to_zna]

Thanks for elaborating Good one
No, no - I'm not literally comparing - actually, I was doing it for your sake so to speak - because I'm not really good at.... well, explaining what I mean :/ 
Anyway - you have been very helpful with explaining TCPView - although the terminology is waaaay beyond my grasp, it makes a tiny bit more sense.
Still, I just want to know if there is reason for concern - if two tabs (for e.g. at this moment, one tab for this discussion, and one for google.com) in a browser can and do produce the many processes showing in the TCPView - most with completely different remote addresses. 

[David H. Lipman]

To determine if their is concern, I would need a screen capture so I can view everything you see to make an evaluation.

[ona_to_zna]

ok - but I still don't know how to do 'Screen Capture' (like I said, I'm a computer 'dummy'). 

[ona_to_zna]

Ok, I found out how to do it (Google does impress me from time to time), now I'll just have to wait for the Google Chrome 'boom' to appear on TCPView, because the traitorous little  &^@%*#$  is now showing only two processes at the moment.

[David H. Lipman]

OK but "Well, if I knew what to do with it, maybe..." doesn't equate, at least to me, as "don't know how to do 'Screen Capture"

 

One way to do this is load TCPView and make it Full Screen.  Then find the "Ctrl" key hold it down and then find the "Prnt Scrn" key.  Then release both keys.

 

Then go into a graphics Program and "Paste as a new image" or hit "Ctrl" key plus the "V" key (Paste) then save the captured graphic as a JPG (JPEG) file.  Then when you reply choose at the bottom right of the web page "More Reply Options" this will provide a facility to attach said JPEG.

[ona_to_zna]

Unfortunately, I have no idea how to post the Screen Capture the way you did, so I'll have to attach it. Is that ok? (Lots of DON"T ATTACH warnings around the forum, so I decided for you to give me an ok )

[ona_to_zna]

We posted at the same time, so I only just saw whiat you wrote. The "Well, if I knew what to do with it, maybe..." refered to what I found as a program for purchasing when I typed it into Google, the first time

[David H. Lipman]

Chrome shows it is making web-page connections to sites via HTTPS (TCP port 443).  In a prima facie examination I don't see anything to worry about.

[ona_to_zna]

Ok, great! Sorry to have bothered you, but this is exactly why I don't mess with things I don't understand - I tend to panic  

This forum is a treasure trove! And you are great, thank you so much for taking the time to ease my mind!

I wish you the best, you deserve it  

Thank you, thank you, thank you, a million thanks! 

[David H. Lipman]

YW