Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i tried running netstat -o to check what are the connections which are established. I saw two and they have PID numbers. When I checked it in my Task Manager, I couldn't find those PID numbers. Is there any way to find them?

share|improve this question
Have you selected the "show processes from all users" button/checkbox? Presumably you're running Windows - what version? – DMA57361 Sep 22 '10 at 8:01
Is it possible that the tasks have simply terminated between the netstat and the launch of Task Manager? – harrymc Sep 22 '10 at 8:24
@DMA5736: how can i show all processes from all users? i'm running windows 7 – tintincutes Sep 22 '10 at 10:11
Press the button indicated in this image, as found here (because I'm not on a Win7 machine at the moment to make my own screenshot). – DMA57361 Sep 22 '10 at 10:33
@DMA5736: i saw it and the other PID represent the spooler subsystem app. and the number 4 represents for the "System" not sure what they are doing in my PC as they represent established. I was suspecting that this might a keylogger or so... – tintincutes Sep 22 '10 at 10:56
up vote 6 down vote accepted

For example:

tasklist /FI "PID eq 736" /FO TABLE

Best tools to investigate Win processes I know about are from Sysinternals

Try using Process Explorer or TcpView

share|improve this answer
do i need to type this in the command prompt? – tintincutes Sep 22 '10 at 8:25
Yes, this is command line tool. Of course change the number of process id. – Casual Coder Sep 22 '10 at 8:36
i just would like to make sure if my understanding is correct. – tintincutes Sep 22 '10 at 10:10
does that mean i write it like this: "tasklist /FI "4 eq 736" /FO TABLE"... where did you get the 736? – tintincutes Sep 22 '10 at 10:11
Sorry, I've made typo. Filter should be "PID eq 736". 736 is example PID number. Ok, you obtain your pid that you would like to investigate further (with netstat -ao I've assumed). Then you type: tasklist /FI "PID eq YOUR_PID_NO_FROM_NETSTAT" and then other options (I added output formatting for instance). You can look up tasklist switches with tasklist /? – Casual Coder Sep 22 '10 at 10:21

To see PID numbers in task manager, first CTRL-SHIFT+ESC will bring up task manager (this is quicker than ctrl-alt-delete).

To show the PID of each process, click view->choose columns->pid and click ok

PID is the second item in the list of columns you can select.

share|improve this answer

You don't need Task Manager for tracking this. Just run netstat -b which will display the exe associated with the PID..

share|improve this answer
...but then how to stop that process? – Arjan Aug 5 '15 at 18:15

Some PID's you can see and some others you cannot. For example, I could not see PID=4 which is System. However I could see many others. Of course, I do not know the reason why. You can use the following command to see them. I have shown here a small portion of the output.

C:\Windows\system32>netstat -nao

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP                 LISTENING       4
  TCP                LISTENING       840
  TCP                LISTENING       8112
  TCP                LISTENING       4
  TCP                LISTENING       7880
  TCP               LISTENING       1080
  TCP               LISTENING       1160
  TCP               LISTENING       4
  TCP               LISTENING       4
  TCP               LISTENING       2216
  TCP               LISTENING       1080
  TCP               LISTENING       8112
  TCP               LISTENING       4
  TCP               LISTENING       3904
  TCP              LISTENING       4
  TCP              LISTENING       1968
  TCP              LISTENING       4
  TCP              LISTENING       4
  TCP              LISTENING       544
  TCP              LISTENING       1012
  TCP              LISTENING       648
  TCP              LISTENING       380
  TCP              LISTENING       1484
  TCP              LISTENING       700
share|improve this answer

go to and download procexp.exe (process explorer) this will provide you with all the relevant details.

otheriwse you can find it in task manager by viewing the column for process ID

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .