Author Topic: How to Find Viruses Using Netstat  (Read 931 times)

Offline javajolt

  • Administrator
  • Hero Member
  • *****
  • Posts: 35986
  • Gender: Male
  • I Do Windows
    • windows10newsinfo.com
How to Find Viruses Using Netstat
« on: January 01, 2013, 05:51:59 AM »
Here we are going to discover How to Find Viruses Using Netstat ? This is just a simple trick that you can find viruses in your computer. This trick was provided by cobija & hackyer and KN.I mentioned steps Bellow to Find Viruses Using Netstat.


PART 1 - Preparing Task Manager
 
Step 1: Open Task Manager (ctrl+alt+del). Go to the processes column and click View > Select Columns



Step 2: Check the top one (PID (Process Identifier))



Step 3: Now, organize Task Manager by PID. This will make things easier to read for the next step.



PART 2 - Using Netstat to see Established Connections
 
Step 1: Now you want to go into Start > Run > cmd > "netstat -ano". It should look similar to the picture below:



Only look for ESTABLISHED connections (it would be established if its a RAT or malicious), read the PID and crosscheck into Task Manager. Notice in my example that the only established connections use the PID 424. Lets take a look at what that is:
 
As we can see, its Firefox. Now lets say you notice the PID reads something like "svchost.exe". You should open the file location by right clicking it and pressing Open File Location and either scan it with Virustotal or check to see if in its legit location (if it was in Appdata or Program Files and it is svchost.exe, then you may have a problem).
 
source:tricksnhacks