How-to: Use NETSTAT.EXE to detect spyware/malware

[MrSneekerss]

just sayin.. doesn't work for vista. unless you are running it as admin. but note. with vista they block it. so you have to enable it.. you can find tuts on here on how to do that :) . p.s nice vid

[behnoudbehrad]

When i type netstat -b it says "The requested operation requires elevation"

[ben00au]

@behnoudbehrad run CMD as admin

[bluebeam90]

@behnoudbehrad If you have windows 7 then you need type search cmd, right mouse button click, click administration then click okay. :)

[redgts00]

Good video... you sound like robert downey jr. lol!

[emandharok]

seth rogan

[paulver00]

Thanks.

[pizza9290]

Can i have thumbs?

i heard it's easy to get thumbs now..

[WgaTray]

@pizza9290 SHUT UP!

[Sumozinho]

hello,i want to know something about this...if i put in the window.netstat -b...it says i am not authorised....?

[bahumat42]

@Sumozinho open as admin

[ENEMENCIO123VISION]

that was very helpful. thank you very much.

[KeepItFresh02]

is this only for windows xp?

[keylllogdark]

@KeepItFresh02 go away...

[bahumat42]

@KeepItFresh02 works on all xp and onward systems



[nikolaiprotovski]

@TheYoshiPC

Stupid? me?

BTW you cant remove a keylogger cause it does not use a port (eccept for mail)

you can remove a remote admin tool but not keylogger...

[TheYoshiPC]

thanks i hope works im going to try to remove a keyloger stupid hackers trying to get password etc

[archie977]

its netstat space -b



[archie977]

is dash mean space bar?

i looked up dash in dictionary it says to smash or destroy

[archie977]

is dash mean space bar?

[ka62666]

@archie977 means a hyphen,dude

[koyi991]

The requested operation requires elevation

[xronnoc7x]

@koyi991 run as admin



[GloriaIsAwesome]

The requested operation requires elevation PLEASE HELP!

[xSTiLik]

Thank u very much! This really helped.

[noe1239]

hey umm on my laptop... when i open command promt.. it says

the command prompt has been disabled by your adimistrator.. and i am the admin. on my computer

what do i do???

[jackanoryjames]

@noe1239 right click command prompt and click on 'run as administrator' and allow

[noe1239]

@noe1239 nope it didnt work...

it tells me the same thing

[dude179861]

the connections will not stop my anti virus keeps popping up with a new connection every 30 seconds or so any clues as to why and is that a problem.

[Josephlive88]

i tried typing netstat -b, but it says the required operations require elevation.

What it means?

[VqwertyV]

@Josephlive88 I think you need to run the command prompt as administrator. Go to start/all programs/accessories and right click on command prompt -> run as administrator

[Josephlive88]

@VqwertyV cool, thanks it works. =)

[AiDz0r]

whats CAT ?

[TrustfulUser]

hey i got windows 7 just wondering why when i type netstat /? it shows me commands like it should but, when i type netstat -b saids needs evaluation

[TrustfulUser]

@TrustfulUser Ok i figured it out in windows 7 u have to open cmd.exe as administrator.... wow i noticed alot of stuff and programs have to be runned with that now interesting

[ersin9mm]

whats netstat -ano stand for?

[Diggensek]

Remember that in Vista/7 you have to run the shell via rclick run as admin via the start menu and even then it's still possible for sophisticated programs to hide the connection. Personal firewalls cannot block this traffic. Unfortunately I can only find German links why Personal Firewalls are inherently unsafe. Google things like ICMP Block.

A firewall is meant to be _between_ your pc and your internet connection (a hw firewall). Basically a router running linux will du the trick with effort.

[drvirusik]

I check netstat through MyLanViewer, it is very convenient to view incoming and outgoing connections for each process separately.

[bigjump3r]

Very informative, I will keep this in mind when monitoring my network.

[MusicKingofTheScene]

informative and useful. thumbs up

[gvrdt1]

Need help removing a virus pay for a AV or get a firewall. Very easy to remove a virus just to long to say.

[asorlonnn]

@gvrdt1 yeah< I need help

How can I terminate connections

I Only want my connection to be one thing I dont want people leeching bullshit on my stuff can you help?

[Diggensek]

@gvrdt1 Actually no. Even simple current gen malware will manage to run persistent backup processes by hijacking root priorities. It is possible for connection to be scrambled and undetectable via netstat. Local running proxies would be one possibility

[Akralaa]

i found 50.17.230.132:443  ESTABLISHED, what can i do to stop him from hacking me

[AtheismandSkepticism]

@Akralaa That's a google IP address. Just do a quick whois lookup to see who its registered to before you get all worried.

There are plenty of genuine active connections on any computer at any time and some may run on after you've closed the application using it.

It is very rare to actually catch a non-genuine active connection with netstat, so I wouldnt' worry.

[yuvi135]

how did you run internet explorer? what program did you use just to write it's name?

Thanks

[lukem95]

@yuvi135 it's launchy

[deemark13]

How-to Use NETSTAT.EXE

Click start, type CMD. Right click the entry in the start menu, choose 'run

as administrator'. Run netstat from the command line.

Note that some parameters, like -b, require elevation to complete

successfully, thus the reason for running it in this manner.

[williamg209]

my txt file would not save

[canofpopproductions]

If you have a weird command and you don't know what it is, just google it.

[djwattz06]

when i do a "netstat -b" it says the requested operation requires evaluation any suggestions why it says that? im using windows vista

[juna2509]

@djwattz06 run as admin

[randomness2132]

whats jqs.exe please let me know send me a messege please

[fevertotell00]

HELP! What doesl CLOSE_WAIT and TIME_WAIT mean?

[DzitarsComputing]

thanks for this, its very useful. ive never heard of this command before

[Niwles]

I have a connection called "jqs.exe"

how do i find out what it is?

[TheBiblemen]

thank so much finally a grown up that doesn't just copy other videos.

[wolf776688]

hi where can i get all cmd s from? i mean i would like to have the cmds where can i download them. is ther any book for cmds?

[RoyalZebraGirl]

but im so confused i don't have that computer or program

[X9Justin9X]

i found my problem now how do i delete it !

[oliverxboxable]

@X9Justin9X kill *file name* deletes it permanently so it doesn't go in your recycle bin... don't want to take any chances then get your anti-virus to do a full system scan and get it to quarantine any malicious programs.

[dkemp61]

lol lets do a netstat-b Also MAN (windows key+R Key)

[luismccoy]

Great video. thank you

[88KRUZE]

mine wont go into netstat -b requires elevation?

[flowerdiary]

@88KRUZE Start (Windows Logo), All Programs, Accessories, right-click Command Prompt, choose to Run as Administrator. This will give you the “elevated” permission to run NETSTAT -B

[RSyemi14]

im curious .... They all say firefox.. but some of them say extablished and dont show the pid # should i be concerned about this ?

[soyothedanny]

what do i do if i cant type backslash on cmd? it just comes out as "W" with a line across..

[Ellixandria]

thanks for a very clear tutorial

i got somemore to add

by typing netstat -ba will get more result

btw...i found wininit.exe trojan currently running without my notice....

thanks again

[X9Justin9X]

@Ellixandria

how do i delete this i got like 5 of these OMFG

[Ellixandria]

@X9Justin9X Download Malwarebytes’ Anti-Malware and Super Anti-Spyware

Both are very good program and can be found in a well known website called such as filehippo or cnet

After download, update it and restart your PC. During the first flash screen press F8 to enter into Safe Mode(this can stop the trojan being running), scan your PC with both programs, It should done the work.

Plus: this is a very good program also but not famous enough compare to the other two, Spybot Search and Destroy,

[7z3p0sU]

10x

[Iamatheist1234]

or maybe i can have a history of all spywares that had been on computer?

[Iamatheist1234]

or maybe i can have a history of all spywares?

[Iamatheist1234]

ok, I have done all my clean up and spyware search IMMEDIATELY after my steam got hacked, but is there any way i can still know if i was hacked before the clean up?

[Iamatheist1234]

@Iamatheist1234 the reason im asking this is that i have never told anyone about my pw on steam, so i have no idea how they got my pw except for key logger , and if they have had a key logger on my computer before clean up they would have access to my bank account, and even steal my personal identity (my address, phone num, and DOB, SSI) so i want to know if i WAS actually hacked, however i have already did the clean up so maybe they no longer have access to my computer

[Iamatheist1234]

@Iamatheist1234 so is there any way to find out if your computer WAS hacked before spyware clean ups?

[MrGreatPoop]

Very useful! Thank you.

[zoliviragh]

Yaaaaay so Im not hacked thx for the vid.

[DennChooch]

i'm 12 and what's this

[bellicromanx]

Thanks for the great vid!

[Eminemtuga]

when I type /netstat -b, I find like 40 ip's connected , I already downloaded spyware doctor, counter spy, and the problem stills, can you help me»

[RSyemi14]

@Eminemtuga um.....those prgrams can be infected them selves ....best thing to use is malwarebytes

[Mi3kka1S4]

@TheDarkcloud2020 No it isn't a virus. It's just a generic host process. In some cases it might be a disguised virus, but i doubt it. Even i have svchosts in my computer and they are harmless.

[Deathray75]

am i hacked i have netbios-ssn



[CedricTheDuck2]

TCP 192.168.1.104:14254 war-pool1-55:1441  TIME_WAIT TCP 192.168.1.104:14254 75-120-52-246:50078 TIME_WAIT TCP 192.168.1.104:14254 c-98-212-190-186:54927 TIME_WAIT

i dont think these look right? should i be worried?

[QlolerQ]

@CedricTheDuck2 I think its your own ip check it.

[hauleywood]

@CedricTheDuck2

your good, those are network sockets on idle machines..

[mandai2]

Some malware can hide their sockets from netstat

[sonofkikkoman]

@TheDarkcloud2020 yes it is and you should definitely remove it

[AXELOPS]

pip pip cheerio, I'm a green little lizard

[tracy10UT]

Another way you can copy it is to right click your mouse, then click on select all, then click on mark. Then open up a text file on your desktop and paste it in there.

One thing I would like to know though, is why Windows always wants permission to install something before you can run Netstat. Are they pulling off their own spying material before it runs?

[tracy10UT]

So what do you do if you have a bunch of foreign addresses connected to your computer? What does that tell you and what do you do to find out who they are?

[juicemedry]

if u are using windows vista or windows 7.

go to start >accessories and right click on run and press 'use as administrator''

it should work from there

[TheMrJurns]

also, after I pull up active connections on the CMD, could you be more speciffic of what to look for as far as spyware or malware. and what does (svchost.exe) mean? is this good or bad? thanks

[sethboy66]

@TheMrJurns it is a generic host process name for services that run from dynamic-link libraries

its just to transfre a .dll file to a .exe it was made by microsoft its nothing bad

[sethboy66]

@TheMrJurns and it is not killable

[TheMrJurns]

what does it mean when you do this and another window pops up & says NO DISK?

[susanbunch1980]

Excellent video! Expert advice! You should upload your video to Ewisdomtv

[jesse9294]

@

b11bc

Stop running Rs servers haha i bet you fail at it anyway lmao

[racing2803]

tks lol

[b11bc]

kool! i got 1 question. i run a private game server on my computer so i have port: 43594 open. there seems to be some nullers now and then trying to flood my server. soo my question is once i find out there ip address how would i ban them form sending any packets to my server as well as connecting to my server. these hackers that try to flood my server send a new connection every second! so how do i make it so some ipaddress can not connect to my server but others can?

[mandai2]

@b11bc Configure your firewall to block those IPs

[Pereetsa]

Thank you so much, what a great video!

Learned a new tool today!

[FridaySternShow]

what does it mean when it says "the requested operation requires elevation"

[stef808]

You're either using Vista or Windows 7 and you need to run the command prompt as the Administrator even if you are logged in as an Admin.

Go to: Start > All Programs > Accessories > (scroll down to Command Prompt) right click and select "Run as Administrator"

Now try it.

[FridaySternShow]

lol yeah I figured it out awhile ago. I should have posted it but I am sure my comment and your answear will help others.

[capman911]

@stef808 Thanks that helped me also.

[Lightiel1]

HOW DO YOU DO THIS FOR MAC?

[FridaySternShow]

@Lightiel1 hahahaahha I AM A PC!!!! buy a pc ;)

[DSAEY]

@Lightiel1 lol mac dont have command its Virus proffet noob

[pooh6913]

Excellent! Thank you!

[ersanjaysoni]

great!!!!!!!!!nice video

[audiaq]

Nice tutorial, simply but usefull

thx

[pgfinn2000]

What does he mean at 4:10 when he says run "utility"? I have tons of stuff when I run netstat and would like to stop all this traffic that runs while my browser sits idle. Thanks.

[JDM32750]

Pretty cool, more ways to find; and perhaps a faster way to see once u close out your apps what's still remaining.

[thisIStheARTofRUIN]

great tutorial, thank you!!

[hathigmonorow]

I've been running Linux for the past few years. Funny how I don't have to worry about spyware and endless reinstalls anymore.

[SovietWrath]

This process requires an escalation?

[gardien78]

@SovietWrath run CMD in admin mode and it will work. right click CMD and click on run as admin.

[gangstafromb16]

u didnt show how to delete these items or ips

[gangstafromb16]

u have 19 names or items on netsta -b is this normal or should i be worried a lot of ip addresses

[slinkyboi321]

my laptop says

The requested operation requires elevation.

when I type in netstat -b

what does this mean.

[gardien78]

@slinkyboi321 run CMD in admin mode and it will work. right click CMD and click on run as admin. This is a feature from vista and probably windows 7 also.

[slinkyboi321]

thank you very much

[emscorsa]

if is windows vista you go on all programs acessessories ,command prompt right-click an run as admistrator!!

[greenmanfest]

top vid nice work ;@)

[TEXASxDR3W]

Good vid, but why does it only work if I have to run as administrator when Im useing a administrator accout?

[inythingatall]

I suppose its so that people on a guest account cant change the password to your Admin account.

[TerryH1984]

Thanks for the tip :)

[cjsanandreas12]

more fast: start,run,cmd,netstat -b

[rainingblood92]

what does it mean if it says the requested operation requires elevation PLEASE HELP ME IVE HAD THIS PROBLEM BEFORE

[pcmedianet]

Start (Windows Logo), All Programs, Accessories, right-click Command Prompt, choose to Run as Administrator. This will give you the "elevated" permission to run NETSTAT -B

[ZehGfather]

@pcmedianet It says: can't find the document, the wordpad document that I've sent to my C:\ root. Sorry to bother, but I can't understand what I'm doing wrong whatsoever, I followed your directions step for step..

[ImperialGuard9001]

@rainingblood92 I HAD THE SAME THING HAHA funnyxD

[Porre1337]

it dident work for me x'D -.-

[stankmcgreen]

That was a great vid, could you produce one that encounters connections that you may not want to be connected too?

[stankmcgreen]

Using netstat?

[ThunderStruck1100]

Great video thanks

[PosterStudios]

Epic! :D

[dazeio]

i'm assuming you're running VISTA. so you've to right-click cmd and click 'run as administrator'..

[homandijcorey]

Thanks a lot man!

[lancenewman1978]

very useful

[DaBossk]

this guys a noob i pwn i 1337

1010010100001

[spoon3888]

hey i have one that says SYSTEM... can some one explain

[larsonj88]

I also get the operation requires elevation, what's this?

[homandijcorey]

Maybe you're not playing U2 in loud enough!

[karynlashea]

Mine saids needs elevation...what is that??

[Frillar]

when you launch cmd, right click and press run as administrator.

[toniboixxx]

mine also says it needs elevation

wtf?

[gloclam]

pls somdebody help me..!!

when i type netstat -b..it only appears like this

"The Requested operation requires elevation"

i nid reply..as soon as possbile.thanks to all^_^

[panchoavendano]

hell, i am in the same!!

[VIVI1337]

very helpful

[KN0MAAD]

Cool

[thehasan1212]

mine says msnmgr.exe or something

[iiiears]

This helpful. Additionally you might also use a boot able cd

WinPE or a Linux boot able CD to generate a checksum of netstat (md5sum | SHA sum ) as a virus may have made netstat untrustworthy. It is also helpful to use a firewall that understands checksums and signed binaries. so that you can be alerted to file size changes that don't correspond to an update. Browse safely create a list of trusted sites for "active" content in IE/Firefox.

[iiiears]

Disabling Flash, Java, Java scripting for everything is no fun right?

[bignube]

thanks man, you save me a lot of headache.

[cowgoesmoo2]

Is it safe to manualy delate the spyware or malware etc????

[pommyrooter]

no its best not but get some software to remove it for you safely to be best but u can do it if u want

[howtowitheb]

great vid but you may want to tell the vista members to right click on cmd and run as admin or you get "the requested operation requires evaluation"