Weird connections when using netstat

[mps727]

My internet connection has been going pretty slow lately. I've scanned for viruses and spyware but didn't find anything. So anyway I came across something that concerns me a little bit. I used netstat -o to view established connections and there's some open for weird things like this for example:

TCP michael-desktop:1715 downloads.aaa1screensavers.com:1716 ESTABLISHED 3084

I am of course a little suspicious of these. They all seem to have the same PID as well. On Windows though I don't know how to look up which process is assigned to which PID. Does this look like malware to anyone else? How can I find more information on this process and removing it? Also, would it be reasonable to assume that this is causing slowdown? There are 7 of these "weird" connections open.

[mps727]

Also, I think I forgot to make it clear, but I was wondering for future reference how to find out what process is assigned to the PID so I can determine what is establishing the connection.

[ithelp]

plug out the network cable for few minutes, and replug and see if the program is still running, the process is using port 1715, so either block the port or find out the process and kill it

[DimaYasny]

if you want to block the connected url permanently, you can enter it into the hosts file, with an ip of 127.0.0.1
that way any malware/spyware won't be able to find it and connect to it

[DimaYasny]

if you want to block the connected url permanently, you can enter it into the hosts file, with an ip of 127.0.0.1
that way any malware/spyware won't be able to find it and connect to it

[DimaYasny]

damn, that was a glitch in the matrix
sorry mods, please erase the extra posts

thanks )

[XTRM]

Especialy good when you notice your internet running continously when you havn' even opend a window yet !!

Start
Run
Type 'cmd'
Type 'netstat'
You will see the strange connection name & ip
If you cant find the ip number type 'nslookup (domain name)' then enter
Once you got Ip and domain name install X-Netstat a free software that can kill and monitor those connections.
Open the program and click refresh, find the connection through the ip or domain name you have and kill it (Kill button).

BUT

Depending on the trojen or whatever the case may be it can come back, annoying.

Under the process section you can see the processes name, remember it.
Press Ctrl+Alt+Dlt
Click Processes tab
Find it and kill

Problem solved

Back to Sleep

[pappuravi80]

tips:
try removing startup items...
update your antivirus/spyware
check with the firewall settings...

Regards,
Pappu R.

[darsh999]

first of all change your anti virus system
it's a spam it generally happens with poor anti virus protection so get a new anti virus and get a rescan i hope the problem will be resolved