My Windows 7 machine is infected. How do I track down IPs?
My Windows 7 machine is infected. How can I tell what IPs my machine is connected to and what it is transmitting or has transmitted? Do I need to change all of my passwords and credit card numbers?
Software/Hardware used:
Software/Hardware used:
ASKED:
July 23, 2010 6:26 PM
UPDATED:
July 25, 2010 11:44 PM
Answer Wiki:
ipconfig /all will show you the IP address. Is this a home machine?
What is it infected with - what does your anti-virus software report? It should also be able to clean the infection.
I would certainly think about changing passwords
++++++++++++++++++++++++++++++++++++++++
I would install Active Ports to review active connections and will show what programs have initialized it. Also install K9 Web Protection from Bluecoat. This would restrict where you computer attempts to go to. Within the Gui (Web Browser), you can see where it's trying to cnnect to as well. Once you have an antivirus on the computer like AVG Free as well as the following tools:
Malwarebytes
Hihackthis (TrendMicro)
Spybot
CCleaner
Good idea to change your passwords. You may want to contact your credit card company to inform them of the situation. They may issue new cards.
Good luck!
To see all answers submitted to the Answer Wiki: View Answer History.
Definitely change the passwords and log ins. But do not do it from this infected PC.
The first thing you need to know is what the machine infected with. Not all malware infections put your passwords at risk (but yes, when in doubt, change them).
You could use Sysinternals’ TCPView to view current tcp connections.
I would recommend to install some good antimalware software, update its definitions, reboot the machine in safe mode without networking, and perform a full scan.
I would also seriously consider disconnecting the machine from the internet (temporarily) going into my control panel and shutting down my “System Restore” on all drives, reboot the machine with the restore off, run the antivirus and spyware scans, (preferably SpyBot Seek and Destroy), making sure your machine is clean of virus/trojans. then I would reboot, and turn the system restore back on creating a new restore point at that time, I would also run the scans again to be certain it was still clean and defiitely change all your PWs.
Format the machine and make backups from now on. When that happens again next time just restore from image before the computer gets infected. I will not trust any security software. None of them has 100% effectiveness.
If your system really is “infected”, then you possibly can’t trust that anything that you download and install won’t become infected or that it will run properly.
On most Windows (and other) systems, you can list information about connections with the NETSTAT command. The command might also not run correctly, but it should at least be immediately available.
Click Start-> Run… and type “cmd” (no quotes) into the entry field, then click the OK button. In the command window, type netstat and press <enter>. A list of connections should appear.
Type “netstat -?” to see basic help for parameters. Type “netstat -abf” for just about the most complete and reliable list of connections, remote addresses, listening ports and executeables as you can get from Windows 7.
Tom