using netstat to recognize malware or spyware

Press the windows key, keep it depressed and at
then press R, this should bring up the run command. Or you could press
Start>all programs>accessories>command prompt.

Type cmd and click OK, this will bring up a black screen as shown below

Then type cd \ this will take you to the root directory



Now type netstat and press the spacebar, then type –b (it will look
like this “netstat –b”) hit enter and you will see a list of any active
connections (that is any applications connecting to the internet),
these are shown on the left hand side of the screen within the [ ]
brackets, if you are only connected to the internet with nothing
running then you will have very little showing on Netstat. However


if you have an antivirus program running you might see something like [ashwebSV.exe] or [nortonSV.exe] but that depends on the antivirus software you have and if its trying to connect to the internet at the time.


If you have anything else running and you don’t
recognise it or it just doesn’t look right then do a Google search to
find out what it is, if it is Spyware, Malware or something else then
get rid of it using your Spyware application (and I hope you have one installed).


Another good tip is to run Netstat every now and
again without closing your applications to keep a check on what
applications are connecting to the internet.


If you want to, you can copy the Netstat list to a
text file by typing netstat then space –b
another space then type > space then type netstat.txt (which would look like this “netstat –b > netstat.txt”) on the
command line and this will copy the netstat list to your root c: drive. All you then have to do is open My computer
and click on the C: drive and you will see a file called netstat.txt
click on it and you will see the Netstat list.