up vote 3 down vote favorite
1
share [g+] share [fb]

i tried running the netstat -o to check what are the connections which are establised. i saw 2 and they have PID numbers when i checked it on my task manager, i can't find those pid number. is there any way how to find this?

link|improve this question
76% accept rate
Have you selected the "show processes from all users" button/checkbox? Presumably you're running Windows - what version? – DMA57361♦ Sep 22 '10 at 8:01
Is it possible that the tasks have simply terminated between the netstat and the launch of Task Manager? – harrymc Sep 22 '10 at 8:24
@DMA5736: how can i show all processes from all users? i'm running windows 7 – tintincutes Sep 22 '10 at 10:11
Press the button indicated in this image, as found here (because I'm not on a Win7 machine at the moment to make my own screenshot). – DMA57361♦ Sep 22 '10 at 10:33
@DMA5736: i saw it and the other PID represent the spooler subsystem app. and the number 4 represents for the "System" not sure what they are doing in my PC as they represent established. I was suspecting that this might a keylogger or so... – tintincutes Sep 22 '10 at 10:56
feedback

2 Answers

up vote 2 down vote accepted

For example: 

tasklist /FI "PID eq 736" /FO TABLE

Best tools to investigate Win processes I know about are from Sysinternals

Try using Process Explorer or TcpView

link|improve this answer
do i need to type this in the command prompt? – tintincutes Sep 22 '10 at 8:25
Yes, this is command line tool. Of course change the number of process id. – Casual Coder Sep 22 '10 at 8:36
i just would like to make sure if my understanding is correct. – tintincutes Sep 22 '10 at 10:10
does that mean i write it like this: "tasklist /FI "4 eq 736" /FO TABLE"... where did you get the 736? – tintincutes Sep 22 '10 at 10:11
Sorry, I've made typo. Filter should be "PID eq 736". 736 is example PID number. Ok, you obtain your pid that you would like to investigate further (with netstat -ao I've assumed). Then you type: tasklist /FI "PID eq YOUR_PID_NO_FROM_NETSTAT" and then other options (I added output formatting for instance). You can look up tasklist switches with tasklist /? – Casual Coder Sep 22 '10 at 10:21
show 5 more comments
feedback
up vote 0 down vote

To see PID numbers in task manager, first CTRL-SHIFT+ESC will bring up task manager. (quicker than ctrl-alt-delete...)

now.. to get PID shown, click view...choose columns..pid..ok

pid is the second item in the list

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.