virus malware - netstat - lots of connections

fire_munki 0 Newbie Poster

17 Years Ago

Hi,
My internet access has dropped to a very very low speed. So I ran nestat - a to see what was open and going on. At least 100 items there, which is a lot.
The computer has been scanned in safe mode by spy bot, adaware, defender and avg but nothing came up.
One sus entry on my hijackthis log but i've removed that.
There is still after doing all this lots of entries, any ideas?
Below is a copy of the netsata -a report:

Active Connections

Proto Local Address Foreign Address State
TCP Dave:0 LISTENING
TCP Dave:0 LISTENING
TCP Dave:0 LISTENING
TCP Dave:0 LISTENING
TCP Dave:0 LISTENING
TCP Dave:0 LISTENING
TCP Dave:0 LISTENING
TCP Dave:0 LISTENING
TCP Dave:0 LISTENING
TCP Dave:0 LISTENING
TCP Dave:0 LISTENING
TCP 127.0.0.1:10080 Dave:0 LISTENING
TCP 127.0.0.1:10080 Dave:49861 CLOSE_WAIT
TCP 127.0.0.1:10080 Dave:49997 ESTABLISHED
TCP 127.0.0.1:10080 Dave:50020 TIME_WAIT
TCP 127.0.0.1:10080 Dave:50022 TIME_WAIT
TCP 127.0.0.1:10080 Dave:50023 TIME_WAIT
TCP 127.0.0.1:10080 Dave:50025 TIME_WAIT
TCP 127.0.0.1:10080 Dave:50026 TIME_WAIT
TCP 127.0.0.1:10080 Dave:50028 TIME_WAIT
TCP 127.0.0.1:10080 Dave:50036 ESTABLISHED
TCP 127.0.0.1:10080 Dave:50046 FIN_WAIT_2
TCP 127.0.0.1:10080 Dave:50048 FIN_WAIT_2
TCP 127.0.0.1:10080 Dave:50050 FIN_WAIT_2
TCP 127.0.0.1:10080 Dave:50052 FIN_WAIT_2
TCP 127.0.0.1:10080 Dave:50054 FIN_WAIT_2
TCP 127.0.0.1:10080 Dave:50056 ESTABLISHED
TCP 127.0.0.1:10080 Dave:50058 ESTABLISHED
TCP 127.0.0.1:10110 Dave:0 LISTENING
TCP 127.0.0.1:13128 Dave:0 LISTENING
TCP 127.0.0.1:18080 Dave:0 LISTENING
TCP 127.0.0.1:49161 Dave:49162 ESTABLISHED
TCP 127.0.0.1:49162 Dave:49161 ESTABLISHED
TCP 127.0.0.1:49163 Dave:49164 ESTABLISHED
TCP 127.0.0.1:49164 Dave:49163 ESTABLISHED
TCP 127.0.0.1:49860 Dave:10080 TIME_WAIT
TCP 127.0.0.1:49861 Dave:10080 FIN_WAIT_2
TCP 127.0.0.1:49863 Dave:10080 TIME_WAIT
TCP 127.0.0.1:49890 Dave:10080 TIME_WAIT
TCP 127.0.0.1:49912 Dave:10080 TIME_WAIT
TCP 127.0.0.1:49997 Dave:10080 ESTABLISHED
TCP 127.0.0.1:50036 Dave:10080 ESTABLISHED
TCP 127.0.0.1:50046 Dave:10080 CLOSE_WAIT
TCP 127.0.0.1:50048 Dave:10080 CLOSE_WAIT
TCP 127.0.0.1:50050 Dave:10080 CLOSE_WAIT
TCP 127.0.0.1:50052 Dave:10080 CLOSE_WAIT
TCP 127.0.0.1:50054 Dave:10080 CLOSE_WAIT
TCP 127.0.0.1:50056 Dave:10080 ESTABLISHED
TCP 127.0.0.1:50058 Dave:10080 ESTABLISHED
TCP Dave:0 LISTENING
TCP 84.53.178.11:http TIME_WAIT
TCP 84.53.178.11:http TIME_WAIT
TCP 84.53.178.11:http FIN_WAIT_2
TCP 84.53.178.67:http TIME_WAIT
TCP 84.53.178.67:http TIME_WAIT
TCP cs-hg04:http ESTABLISHED
TCP 213.199.164.110:http TIME_WAIT
TCP cs-hg04:http ESTABLISHED
TCP a522sl:http CLOSE_WAIT
TCP a522sl:http CLOSE_WAIT
TCP a522sl:http CLOSE_WAIT
TCP a522sl:http CLOSE_WAIT
TCP a522sl:http CLOSE_WAIT
TCP 84.53.178.42:http ESTABLISHED
TCP a522sl:http ESTABLISHED
TCP [::]:135 Dave:0 LISTENING
TCP [::]:445 Dave:0 LISTENING
TCP [::]:554 Dave:0 LISTENING
TCP [::]:2869 Dave:0 LISTENING
TCP [::]:5357 Dave:0 LISTENING
TCP [::]:10243 Dave:0 LISTENING
TCP [::]:49152 Dave:0 LISTENING
TCP [::]:49153 Dave:0 LISTENING
TCP [::]:49154 Dave:0 LISTENING
TCP [::]:49155 Dave:0 LISTENING
TCP [::]:49156 Dave:0 LISTENING
UDP *:*
UDP *:*
UDP *:*
UDP *:*
UDP *:*
UDP *:*
UDP *:*
UDP *:*
UDP *:*
UDP 127.0.0.1:1900 *:*
UDP 127.0.0.1:51619 *:*
UDP 127.0.0.1:52552 *:*
UDP 127.0.0.1:58842 *:*
UDP 127.0.0.1:62654 *:*
UDP 127.0.0.1:62655 *:*
UDP 127.0.0.1:62656 *:*
UDP *:*
UDP *:*
UDP *:*
UDP *:*
UDP [::]:123 *:*
UDP [::]:500 *:*
UDP [::]:3702 *:*
UDP [::]:3702 *:*
UDP [::]:5004 *:*
UDP [::]:5005 *:*
UDP [::]:5355 *:*
UDP [::]:54924 *:*
UDP [::1]:1900 *:*
UDP [::1]:58839 *:*
UDP [fe80::8c9:bf5:f013:4137%10]:1900 *:*
UDP [fe80::8c9:bf5:f013:4137%10]:58838 *:*
UDP [fe80::380c:31f9:3f57:fefc%12]:1900 *:*
UDP [fe80::380c:31f9:3f57:fefc%12]:58840 *:*

1 Contributor
0 Replies
124 Views

Dani AI

Generated 9 Months Ago

— many entries in a netstat dump can be normal, but they do make slow browsing obvious. The immediate goal is to map sockets to the processes that created them so you can see whether a legitimate Windows service, a browser/proxy, or a rogue process is responsible.

Run netstat to get PIDs, then inspect those PIDs in Task Manager or with tasklist/Process Explorer. Example commands:

netstat -ano
tasklist /FI "PID eq <pid>"

Use Resource Monitor (resmon) or Sysinternals TCPView to watch per-process network usage in real time and to identify any process that holds many sockets. TCPView and Process Explorer show the executable path, which helps distinguish system services from third‑party programs. netstat docs | TCPView | Process Explorer

Brief notes on connection states: TIME_WAIT just means the socket is waiting to clear after close and is usually harmless; CLOSE_WAIT indicates the remote end closed and the local process still needs to close its socket — many CLOSE_WAITs usually point at a misbehaving program. See the TCP state explanation for details: Transmission Control Protocol

If a PID looks suspicious, stop that process (carefully), scan with an extra tool such as Malwarebytes, and check startup items with Autoruns. If network activity persists after stopping/removing the app, isolate the machine, check the router for unexpected port forwards, consider an offline/rootkit scan, and back up important data. When in doubt, capture a short packet trace with Wireshark for analysis or seek a full cleanup — but avoid uploading captures with sensitive data. Malwarebytes | Autoruns

Be the first to reply

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.