Is Your Computer Connecting To Websites Without Your Knowledge
If you are worried that some programs on your PC are secretly making connections to websites in the background, here's a quick tip that uses a simple DOS command to detect and prevent such suspicious activity:
1. Type cmd in your Windows Run box.
2. Type "netstat -b 5 > activity.txt" and press enter. After say 2 minutes, press Ctrl+C.
3. Type "activity.txt" on the command line to open the log file in notepad (or your default text editor)
The file activity.txt will have a log of all process that made a connection to the Internet in the last two minutes. It will also show which process connected to which website in this time. And not just the web browsers (like iexplore.exe or opera.exe), the log will also show your IM clients, download managers, email programs or any software that requires a net connection.
Scroll though the activity.txt file and look for any process names or website addresses that you are not aware of. If you track one , go to the task manager (or Process Explorer) to find the location of the executable on your computer and eliminate it.
Subscribe in a reader
Download Free Google Software:
Reader Comments:
netstat -b 5 ???
Maybe, but not for my Win2K, but no worry, I'm a fan of ethereal.
Marco
I am using xp sp1 and it does not have any -b there...
it should be netstat -a 5 and it displays the statistics with updates again and again after 5 seconds..
so it should be "netstat -a 5" Am I correct?
It is "netstat -a 5" in Win2k Server..
both -a and -b are valid modifier. For a list of valid modofier, type "netstat help" in command window
or get TcpView from sysinternals
I usually use netstat -a to see connections. But netstat -b 5 was a cool idea as well.
No offense, but the author should have suggested using a firewall.
The ones I use (work and home) alert me to programs requesting internet access as they request it. I can then approve it or decline it. I can permanently block that program from accessing the internet for as long as the firewall is in place - which is always.
If you're paranoid-enough to open a DOS-box to try and figure-out which unknown programs tried connecting to the internet without your knowledge, shouldn't you be using a firewall anyway?
Hey shit brick, the post is useful. Any idiot knows that using a firewall is ideal, but c'mon, how many people are familiar with DOS commands now-a-days.
Maybe you should advice people to search on the web the processes they find using your trick, before simply eliminating them...
I agree, if that person is so proud and confident of his firewall, why is he even reading this article????
Maybe I'm missing something but this log really doesn't help me. Most of the activity connecting to sites/ URIs that I'm not familiar with are being done in Firefox or TCP.
With Firefox, i'm assuming many of these are ad network activity on a given web page.
With TCP, it's not in the process table so I can't drop it.
Then I have a well-known mindmapping program which seems to be connecting out to a business blog not associated with them.
very strange.
There's no excuse thesse days for not using a firewall. Use a software firewall if you don't have a hardware firewall for your network. But, not all firewalls let you block outgoing ports that aren't explicitly needed. An alternative to netstat is ZoneAlarm. There is a free version that will let you set up allowed outgoing connections on an application-by-application basis.
All of the posters talking about firewalls are missing the point. You don't want to just block the outgoing traffic of said malware. You want to identify and remove it.
Great post.
Good for educating those that don't know how to use a ... "dos-box".
Have a question? Need help? Visit the forums ».