The computer has more than 65 thousand ports. Some of them are busy with the programs that opened them. All others are free. In the event that the user notices suspicious network activity on the computer, you should look at the open ports and find out which programs open them.
Instructions
Step 1
A properly configured computer communicates with the Internet only in two cases: when you yourself are working on the network, and when the anti-virus databases or the operating system are updated. If you see that the computer itself "climbs" into the network, this is a reason to check it.
Step 2
You should be aware that even a computer protected by antivirus and firewall is not invulnerable. Hackers have long learned to deceive the most famous security programs, so keep a close eye on the behavior of your computer and regularly check open ports.
Step 3
To check open ports, open the command line: "Start" - "All Programs" - "Accessories" - "Command Prompt". There is also an easier way: "Start" - "Run", enter the cmd command and click OK. Type netstat –aon in the command line window, run the utility by pressing Enter.
Step 4
The first column of the table that appears shows the type of network connection. In the second - "Local address" - you will see local addresses and open port numbers (after the address, after the colon). The column "External address" contains the network addresses to which your computer connects.
Step 5
Pay attention to the "Status" section, which shows the status of the connection: ESTABLISHED - the connection is established. LISTENING - waiting for a connection. CLOSE_WAIT - connection ended. Finally, the last column - PID - shows the process ID. This is the number under which this or that process appears in the system.
Step 6
Thanks to the presence of the PID, you can understand which program is opening a particular port. For example, you see that you have open port 1499, its identifier is 1580 (your data will be different). Type tasklist in the same command line window. A list of all processes will appear in front of you, while their identifiers (PID) are indicated in the second column. Now you need to find in this column the PID you are interested in, in this case 1580. Find, look in the column on the left for the name of the process - let it be AAWService.exe.
Step 7
If the process name is unfamiliar to you, enter it in the search bar. We entered, received information - the process belongs to the software Ad-Aware. Do you have such a program on your computer? Does it start automatically at startup? Do you need it? Run the Aida64 (Everest) program and look at the startup folder and, if necessary, delete the Ad-Aware file from it. If you don't have such a program, AAWService.exe is a Trojan process masquerading as a popular utility. Use this algorithm to check all other applications that open ports.
Step 8
Pay particular attention to connections with the LISTENING state. The application listens on the open port, waiting for a connection. Similarly, both "legitimate" programs - for example, Windows services, and Trojans, waiting for a connection to be established with them, can behave.
