Is it possible to write a script to see which processes/programs are sending/receiving data over the internet in Windows XP? I have full administrator rights and I want to find a way to monitor data exchange on my machine without installing any additional software.
1 Answer
Step One: Windows XP
Open up the Run box by pressing the Windows key and R at the same time.
Put in CMD and press OK. The command prompt window will open up:
Step Two
In your open Command Prompt window, enter the following:
netstat -b 5 > activity.txt
and hit enter. (Note: to paste something into Command Prompt, you'll need to right click and click paste.)
If you forgot to run the prompt as an administrator (like I did in the screenshots above), just redo step one You can tell when it's running as administrator because instead of saying C:\Users\Username it says C:\Windows\system32.
If you've pasted the code right, a blinking cursor will... blink.
After a few minutes, press Ctrl+C. That'll stop the command.
Now type in command prompt activity.txt to open the log:
When you press Enter, your default text editor-probably Notepad-will open:
Now, scroll through the lists. You'll see that it's mostly your browser-but some times, there are programs like Google Talk's webcam program installed that call home even when you aren't using them.
Now that you've found any and all culprits that are programs accessing the internet (with and without your knowledge), you can either close them from the Task Manager or even uninstall them.
-
thanks guys for the suggestions i used netstat and came up with only two processes chrome.exe and jqs.exe both of whuch are non malicious but still i have doubts bcoz my network activity shows 730k bytes sent and 6400k bytes recieved these figures mean i should get a good browsing speed but in fact i am not am i missing something? is it possible there may be processes not setected by netstat? Commented Feb 19, 2012 at 20:15
-
1you have to clear your temp folder and clear your prefetch folder Commented Feb 19, 2012 at 20:17
-
netstat -e -s -p tcp -b