Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

i tried running netstat -o to check what are the connections which are established. I saw two and they have PID numbers. When I checked it in my Task Manager, I couldn't find those PID numbers. Is there any way to find them?

share|improve this question
    
Have you selected the "show processes from all users" button/checkbox? Presumably you're running Windows - what version? –  DMA57361 Sep 22 '10 at 8:01
    
Is it possible that the tasks have simply terminated between the netstat and the launch of Task Manager? –  harrymc Sep 22 '10 at 8:24
    
@DMA5736: how can i show all processes from all users? i'm running windows 7 –  tintincutes Sep 22 '10 at 10:11
    
Press the button indicated in this image, as found here (because I'm not on a Win7 machine at the moment to make my own screenshot). –  DMA57361 Sep 22 '10 at 10:33
    
@DMA5736: i saw it and the other PID represent the spooler subsystem app. and the number 4 represents for the "System" not sure what they are doing in my PC as they represent established. I was suspecting that this might a keylogger or so... –  tintincutes Sep 22 '10 at 10:56

3 Answers 3

up vote 4 down vote accepted

For example:

tasklist /FI "PID eq 736" /FO TABLE

Best tools to investigate Win processes I know about are from Sysinternals

Try using Process Explorer or TcpView

share|improve this answer
    
do i need to type this in the command prompt? –  tintincutes Sep 22 '10 at 8:25
    
Yes, this is command line tool. Of course change the number of process id. –  Casual Coder Sep 22 '10 at 8:36
    
i just would like to make sure if my understanding is correct. –  tintincutes Sep 22 '10 at 10:10
    
does that mean i write it like this: "tasklist /FI "4 eq 736" /FO TABLE"... where did you get the 736? –  tintincutes Sep 22 '10 at 10:11
    
Sorry, I've made typo. Filter should be "PID eq 736". 736 is example PID number. Ok, you obtain your pid that you would like to investigate further (with netstat -ao I've assumed). Then you type: tasklist /FI "PID eq YOUR_PID_NO_FROM_NETSTAT" and then other options (I added output formatting for instance). You can look up tasklist switches with tasklist /? –  Casual Coder Sep 22 '10 at 10:21

To see PID numbers in task manager, first CTRL-SHIFT+ESC will bring up task manager (this is quicker than ctrl-alt-delete).

To show the PID of each process, click view->choose columns->pid and click ok

PID is the second item in the list of columns you can select.

share|improve this answer

Some PID's you can see and some others you cannot. For example, I could not see PID=4 which is System. However I could see many others. Of course, I do not know the reason why. You can use the following command to see them. I have shown here a small portion of the output.


C:\Windows\system32>netstat -nao

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       840
  TCP    0.0.0.0:443            0.0.0.0:0              LISTENING       8112
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:554            0.0.0.0:0              LISTENING       7880
  TCP    0.0.0.0:1521           0.0.0.0:0              LISTENING       1080
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1160
  TCP    0.0.0.0:3500           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:5357           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:6600           0.0.0.0:0              LISTENING       2216
  TCP    0.0.0.0:8080           0.0.0.0:0              LISTENING       1080
  TCP    0.0.0.0:8081           0.0.0.0:0              LISTENING       8112
  TCP    0.0.0.0:8090           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:8093           0.0.0.0:0              LISTENING       3904
  TCP    0.0.0.0:18050          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:30761          0.0.0.0:0              LISTENING       1968
  TCP    0.0.0.0:32843          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:32844          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:49152          0.0.0.0:0              LISTENING       544
  TCP    0.0.0.0:49153          0.0.0.0:0              LISTENING       1012
  TCP    0.0.0.0:49154          0.0.0.0:0              LISTENING       648
  TCP    0.0.0.0:49155          0.0.0.0:0              LISTENING       380
  TCP    0.0.0.0:49156          0.0.0.0:0              LISTENING       1484
  TCP    0.0.0.0:49202          0.0.0.0:0              LISTENING       700
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.