Comments on: My Windows 7 machine is infected. How do I track down IPs? http://itknowledgeexchange.techtarget.com/itanswers/my-windows-7-machine-is-infected-how-do-i-track-down-ips/ Wed, 22 May 2013 05:05:11 +0000 hourly 1 By: Featured Member: Valmsmith - ITKE Community Blog http://itknowledgeexchange.techtarget.com/itanswers/my-windows-7-machine-is-infected-how-do-i-track-down-ips/#comment-79775 Featured Member: Valmsmith - ITKE Community Blog Thu, 29 Jul 2010 06:11:14 +0000 #comment-79775 [...] but that hasn’t kept him from being very active in the forums. Check out his answers about Windows 7 in 2010, Windows XP, Windows Server 2003 or SBS 2003. Thanks for hitting the ground running, [...]

]]> By: Featured Member: Darkstar911 - ITKE Community Blog http://itknowledgeexchange.techtarget.com/itanswers/my-windows-7-machine-is-infected-how-do-i-track-down-ips/#comment-79683 Featured Member: Darkstar911 - ITKE Community Blog Tue, 27 Jul 2010 06:08:34 +0000 #comment-79683 [...] out around the forums for the past couple weeks. Whether it’s Windows Server 2008, Oracle, or Windows 7 in 2010, Darkstar911’s been laying down the knowledge. Thanks for helping us out, and keep up the [...]

]]> By: tomliotta http://itknowledgeexchange.techtarget.com/itanswers/my-windows-7-machine-is-infected-how-do-i-track-down-ips/#comment-79633 tomliotta Sun, 25 Jul 2010 23:44:09 +0000 #comment-79633 If your system really is “infected”, then you possibly can’t trust that anything that you download and install won’t become infected or that it will run properly.

On most Windows (and other) systems, you can list information about connections with the NETSTAT command. The command might also not run correctly, but it should at least be immediately available.

Click Start-> Run… and type “cmd” (no quotes) into the entry field, then click the OK button. In the command window, type netstat and press <enter>. A list of connections should appear.

Type “netstat -?” to see basic help for parameters. Type “netstat -abf” for just about the most complete and reliable list of connections, remote addresses, listening ports and executeables as you can get from Windows 7.

Tom

]]> By: darkstar911 http://itknowledgeexchange.techtarget.com/itanswers/my-windows-7-machine-is-infected-how-do-i-track-down-ips/#comment-79606 darkstar911 Sat, 24 Jul 2010 01:43:43 +0000 #comment-79606 Format the machine and make backups from now on. When that happens again next time just restore from image before the computer gets infected. I will not trust any security software. None of them has 100% effectiveness.

]]> By: valmsmith http://itknowledgeexchange.techtarget.com/itanswers/my-windows-7-machine-is-infected-how-do-i-track-down-ips/#comment-79604 valmsmith Sat, 24 Jul 2010 00:20:22 +0000 #comment-79604 I would also seriously consider disconnecting the machine from the internet (temporarily) going into my control panel and shutting down my “System Restore” on all drives, reboot the machine with the restore off, run the antivirus and spyware scans, (preferably SpyBot Seek and Destroy), making sure your machine is clean of virus/trojans. then I would reboot, and turn the system restore back on creating a new restore point at that time, I would also run the scans again to be certain it was still clean and defiitely change all your PWs.

]]> By: carlosdl http://itknowledgeexchange.techtarget.com/itanswers/my-windows-7-machine-is-infected-how-do-i-track-down-ips/#comment-79584 carlosdl Fri, 23 Jul 2010 19:02:27 +0000 #comment-79584 The first thing you need to know is what the machine infected with. Not all malware infections put your passwords at risk (but yes, when in doubt, change them).

You could use Sysinternals’ TCPView to view current tcp connections.

I would recommend to install some good antimalware software, update its definitions, reboot the machine in safe mode without networking, and perform a full scan.

]]> By: technochic http://itknowledgeexchange.techtarget.com/itanswers/my-windows-7-machine-is-infected-how-do-i-track-down-ips/#comment-79582 technochic Fri, 23 Jul 2010 18:40:36 +0000 #comment-79582 Definitely change the passwords and log ins. But do not do it from this infected PC. :-)

]]>