How to Use NETSTAT & FPORT Command to detect spyware, malware & trojans by Britec

[@Stiggandr1]

Thank you so much. All these guides talk about using netstat to identify trojans, but the steps always go. Step 1) Eliminate known ports and connections. Step 2) Run whois on unknown TCP connections. Step 3) Disregard everything you just did and run a virus scan. This is so useful, even years later.

[@davidfont2596]

Almost ten years later and this is still a useful, well thought out tutorial.

[@Britec09]

Thanks

[@vanex0-0]

u doing well now?

[@momogunsabah]

2024, 14 years

[@jcantonelli1]

14 years later and this video is still relevant - thanks!

[@sickwtw]

14 years ago and still helpful

[@tubeDude48]

CTRL-DEL doesn't always work, but CTRL-SHIFT ESC will! Also, once PIDs are showing, click on PID to put them in number order. This will speed-up looking for the PID.

[@jerrylangebek5682]

Amazing! The knowledge you bring forth with the clear and concise explanation of its use is extremely helpful. Thank you so much!

[@jeffreytimothyvalerie7540]

It was wonderful to notice that you had Kaspersky included, my preferred choice of anti-virus

[@peterdasa1262]

Ive probably watched 10 different spyware removal videos today They pretty well were all trying to say the same thing but you were by far the easiest to understand ..

[@funnykat1566]

Need an update to 2019

[@azurestarton]

This helped me out a lot. My computer was hacked and my cursor was moving on it’s own. I got enraged so I decided to deal with this.

[@amyamy534]

Nice one Brian. Mine was all clear but a relief to know. Very followable video even for me! Good job.

[@Britec09]

@BearHit did you put the fport folder in c: root directory? and then run it for command line?

[@Subparanon]

Actually if you have spyware that has installed a backdoor in your computer it would be LISTENING. Those 127 addresses that are established are your local loopback connections. When two pieces of software on your pc need to communicate with each other say different services your pc runs, they will use local loopbacks to do so. If your Itunes needs to talk to the apple mobile device manager, it's going to do it with a 127.0.0.1 IP.

[@sarahbrigida6678]

on windows 10 u have to go to processes and right click cpu and then select PID

[@hackerperson6164]

Sarah Latschkowski your right sweetie 😍😍

[@kip556]

Netstat can also achieve this by being run as admin and using the switch -naob

[@sebastian_bluemel]

Stupid creeps

[@gregmendoza7833]

Sarah Brigida thank you lmao it was that easy

[@Britec09]

Your welcome John.

[@pdenist]

This was an awesome video. For someone like myself who is so green it is not funny. I learn a lot!! Thanks from VA!!

[@sevengenerations8879]

A 2019 update is requested indeed! I was playing around with Process Monitor (part of the Sysinternals suite by Microsoft) because task manager is lacking ... it's more complex, but maybe easier in the end ....

[@jari2018]

windows taskmanager are for android and tab kids/users -and its totally useless in windows 10 -what a piece of junk

[@Britec09]

its part of ITunes and Quicktime, should be safe just disable service if you dont want it

[@Stewie4321]

Great video Brian, very well narrated and a very useful tutorial....thanks!

[@CoramDeoHawaii]

Very cool Britec - still the best pc guru!

[@instaminox]

The requested operation requires elevation 🚨🚨🚨🚨

[@carlamuzquiz1233]

great videos very helpful with lots of information and you have a great way of explaining things clear and simple

[@teamofwinter8128]

Thank you very much i am from the future 2020 but thank you I wasnt able to use fport but i did the -ano and task manager Also i was unable to use spyware guide i just searched the process or program name and google got ur back

[@gunjin2112]

this is one of the best video tutorials that i've found yet! thanks! :D

[@IvoNordman]

Adding -b after netstat lists executables along with their requested addresses. Or use TCPView freeware to view the connections in real time

[@Britec09]

ESTABLISHED means there is a connection. So if you go to your browser and open it on a page you should see ESTABLISHED.

[@georgegates526]

This is cool stuff Britec!!

[@franklingregg4743]

Thanks for the spyware and virus tips,,will be following you...how are you on Linux OS..?

[@Chng30FsCenEry]

Excellent video! Thank you for posting it.

[@MrFourseven]

Oldie but a goodie cheers bad

[@WmTyndale]

What is keeping the malware from replacing your NETSTAT with a hacked copy of netstat?

[@YANA4123]

Thank you for the help and clear discriptions. cheers

[@Britec09]

are you sure its a rootkit? have you scanned with gmer, also moving mouse could be down to a settings problem with your mouse

[@tacosplease4906]

If you are not connected to the internet should there be "ESTABLISHED " connections?

[@Britec09]

you can try panda root kit cleaner, sounds like a root kit you got, not easy to get rid of. try deleting it in safemode in command prompt or use a program call unlocker and kill process.

[@ne12bot94]

Question on backdoor , is their a away to manipulate the backdoor program and used it to your advantage?

[@Islandscout8]

Great and logical video. Though, the Fport link is no longer available. Also, in Windows 8, you can find where the program is located by right clicking it in task manager, then selecting "Open file location"

[@BigHud83]

Great explanation

[@satamique]

Thank you! Still relevant in 2018 :)

[@concisejellyfish]

1. open command. 2. enter :: cd c:\ 3. enter :: shutdown -i {brings up the gui mgmt. for network remote shutdown} 4. add 5. add the computer name using ip [netstat] with the port used the rest is self explanitory

[@AnthonyCastano]

Very excellent video!!! Thank you. You pushed me in the right direction to find a virus in my cyber security class :)

[@1pcmedic]

Sandysuicide, if the command requires elevation, rt click on the cmd program and chose run as administrator. Or when you double click the command prompt icon, hold the shift key down this automatically opens a elevated command prompt...

[@jerryblack7719]

I noticed when I get rid of the trackers a lot of the established connection go away. If I kill them, will those connections stop?

[@Mike-wk6sn]

Thanks, I think i just nearly got scammed today by one of those indian guys pretending yo be my phone company calling about unknown users using my ip address. He had me opening the cmd window and stuff and showing me how there were several unknown ip address on the netstat list. Thankfully they hang up mid way. I called my phone company about it and they said it's a scam. I called my bank and suspended & cancelled my credit card immediately. Thanks, I now know how to check if there's a malware on my pc.

[@BertholdHinrichs]

well organized explanation, thanks

[@eyalo99]

If I don't find the PID number in the Task Manager, how can I locate the process?

[@seanblake2489]

Great Job, Thanks for uploading.

[@dearvifa3490]

i'm trying to active NETSTAT -B but is not working. the command said the requested operation requires elevation ? could you pls help me with it

[@1pcmedic]

Great job! Keep up the good work.

[@pradeepmane1998]

Thanks for the information and video.

[@rickylove831]

Outstanding! Thanks a bunch.

[@noseyparker6969]

Are there instances where the PID number doesn't show up in the taskbar monitor? If so, what would you need to do? Cheers BRI, once again

[@doogerville]

I had this too. just click where it says,"all" process. that will list it.

[@noseyparker6969]

thanks for that :)

[@joeycarr1398]

Under Processes in Task Manager there are always PID's presentwhich you may kill with the TASKKILL COMMAND c:\>taskkill pid number

[@franciscoholguin855]

Since the requested operation requires evaluation???????

[@salsabil44]

Have I missed something? I´ve checked the Established PID numbers and they all correspond to a running process. Does that mean all is well? Or could a trojan or RAT not be disguised as a legit process? Is that not what they would normally do? So, in that case, how do we identify if all running processes are legitimate?

[@Akuma_Raou]

What if you have PID listed in your Netstat you can not find?

[@Will-fr9hg]

Should I be worried about a statues of syn_sent?

[@fekkyb]

Hello Brian. I have a friend living in the US who recently has experienced strange things happening to his MSN email account. He’s not receiving mail from random people/email addresses. What can he do? Any ideas?

[@marcomeeuwsen9891]

So what if the PID number isn't showed @ taskmanager?

[@guitian54]

after you kill the process is there anything else that should be done

[@noname2020x]

Thanks, great video and you hit the nail on the head!

[@sarahmiles6821]

I followed your directions, but the PID number list to the right of of cmd, is missing. I have Windows 8

[@sarahmiles6821]

Nevermind.. got it

[@imitatioDei]

Hey great video . I have a problem there is a PID with an established connection but it doesn't show up in task manager. I found all the others except for one . Can you help?

[@ChathurangaLakmal]

Thank you so much. This was very helpful. I'm using Windows 7 Ultimate and this works perfectly. Cheers.........!

[@Britec09]

just run malwarebytes and superantispyware to remove trojans and spyware

[@Britec09]

@Karloki100 your welcome

[@camiloroa3182]

Britec thanks in advance for your video, it was really informative and illustrative. However, I do know time has passed and I’m new on all this I was unable to configure or set up fport do you know how can I do it? Is it still available?

[@chuckfinley400]

Hi and Thanks for posting this video.. its been really helpful... Question I'm unable to use the -b, the response is the command needs elevation.. what does that mean? thanks again

[@ltg2227]

run command prompt as admin

[@onearmfrog]

Great video - Very useful! Thanks!

[@jasonmcrgregor4476]

hello quick question, i have established connections but its not on the task manager when i cross reference it. what do i do?

[@DFish-pb5pt]

when I type netstat.exe it says that the requested operation requires elevation....

[@vicky5573]

put command prompt in start menu>right click on it>more>click on admin

[@doogerville]

Very well done Sir, thanks.

[@TheVijeeth]

hi when I type netstat -b, it says "the requested operation requires elevation". please help me

[@teamofwinter8128]

Same

[@Macskinny76]

i don't think it works for windows 10, mine did the same thing.

[@vybezz6359]

run cmd as admin

[@ArmedBubble15]

Right click command promt and use run as administrator

[@miguelgarciagines]

Excellent and useful video.....thank you..

[@pradyb646]

You are a legend.

[@Blub0r]

very nice video. helped me a lot!

[@notokay2485]

What if the PID present in the command is not in the task, what should I do?

[@WalkerStevensFineArt4U]

Dear Adrian, do you know if this is still relavent today? I've been hacked, and the hacker wants $$$, or he says he's going to formatt my hard drive. I need to find the malicious rootkit he says he's implanted in my hard drive. He says he's using a VNC Protocall, but I checked the permissions, and off-site permissions, and it doesn't show anyone has gotten past my security, or controlled my computer from off-site, yet someone has changed my passwords several times. Can you help me? Or, do you know someone who might be able to? Kind Regards, walker Stevens

[@Britec09]

@gunjin2112 your welcome

[@lefterispanos9543]

Is there a way to permanently block an IP of a pid process that you found , that it might be a Trojan. Apart from using ps kill of course to kill the process.

[@ns-yz1hj]

Of course if some skid didn't write the malware and it beacons back to it's c&c, then this doesn't do you much good does it?

[@joeyd31215]

Good stuff here!

[@Archon51]

Go to start>accessories> (right click) Command Prompt and run as admin.

[@shinzengumi]

Hello, great video however I have a question. What does it mean if I find a PID listed on netstat -ano but it is not listed on my task manager PIDs? Thanks!

[@juukame]

very nice vid keep em comin

[@matthewmander4490]

thanks mate, very informative.

[@juggernautz]

Looks great except witn WIN7 I enter netstat -b I get a response "requested operation requires elevation" what does that mean and how do I get to the next screen? How do I open the next screen so I can review settings after typing netstat -b ? I have no issues with netstat -ano in fact the only PID's in question were from Google Chrome which is normal unless chrome has a live hack so I think those PID's are okay. Problem is days earlier I got hacked and my firewall & antivirus was disabled along with spyware and the jackal changed my screen saver and screen background to black. Nothing missing plus I write down all important (financial etc) passwords on a mini notebook. My email sub files were all opened and normal Thunderbird does not open sub files just the main email file opens to read & download email. Browser password protection is lousy & they know they lie about it because of constant threats security is our problem.

[@merakibreezyy5554]

run cmd as administrator and it should work just fine :)

[@ivanakoprivica5784]

Hello, I have one question. What if in cmd shows that there is one established connection with PID but in the task manager there is not that PID. What then?

[@tim3854]

I would like to know this too

[@doubled5659]

same with me , have u figured out the problem so far ?

[@camiloroa3182]

Check it by the IP address online.

[@jonpaulchavez1459]

need an update for 2020 and it looks "show process for all users" was uncheck is it needed?

[@Britec09]

trouble with rootkit is there hard to detect, if I was you, I would do a operating system rebuild, that way your be sure its gone, rootkits let the person come in and out of your computer when they like. But if your sure its gone and you have deleted it then your be fine rescan with rootkit scanner to make sure somethink like gmer

[@Britec09]

Hi Soilgirl Use malwarebytes and superantispyware and vundofix run them in safemode and you should be all clean. let me know how you get on Brian

[@Maitreya888]

Excellent, thank you

[@XristosVaxevanosgritec]

britec create a video to show us which ports are dangerous for virus and malware and how close them.

[@Britec09]

Thanks Alot

[@MrBl8245]

brilliant mate.

[@ChathurangaLakmal]

@theCIAguy007 I had the same problem & I found the solution. What you have to do is just open command prompt as administrator. (Just go to start>All Programs>Accessories> and Right click on Command Prompt and click on "Run as Administrator)

[@i8ab]

I found some "established" connections when I pulled up that list. I had closed all other windows, so I am concerned. I checked each by name on "Spywareguide", and no results were found for most, only 1 called "system", didn't seem to be very dangerous. Does this mean I may be ok? Perhaps they are supposed to be there?

[@s94200.]

after downloading fport from the mentioned site, im unable to run the command. Error message "fport is not recognized as an internal or external command, operable program or batch file". How do i resolve this issue?

[@Britec09]

your welcome

[@jtd4847]

What if you have a established port that does not show up in the task manager? Is there a way to kill this port and is it a hacked port?

[@AngelofDeath1432]

What does it mean when you type in comand prompt ''netstat -b'' the you get the message ''the requested operation requires elevation''?

[@LeandroBarbksa]

It means you need to run the CMD as an administrator. If it's Windows 10, right-click the Command Prompt in the start menu and select "Run as administrator".

[@carlegleason1383]

@@LeandroBarbksa Right click on CMD give Y administrator

[@carlegleason1383]

gives you the Adm.

[@MrOnfireforGod]

I have downloaded fport and pskill. How can i use them in command prompt?