Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I ran netstat -no and all these addresses came up:

http://i.stack.imgur.com/Kwnfz.png

I had just restarted my computer and nothing was even running except for the command prompt. I didn't even have a browser open and I keep my computer very clean and organized.

Do I have a virus? What's with all the active connections?

(Windows 7 64-Bit)

share|improve this question
3  
Note that TIME_WAIT is not "active"; it's the remains of a closed connection. Having many of these is normal when browsing the web. –  grawity Sep 24 '11 at 11:39
add comment

2 Answers

up vote 7 down vote accepted

Picking one of the more common addresses at random (I chose 72.14.204.120) and putting it into a web browser appears to go straight to Google so I would have to say that the 72.14.204.XXX address range is pointing at Google and is most likely a result of the Google+ integration that is becoming more prevalent in every web page you visit. It seems that google want to keep a close eye on what you do these days and so their connections are ongoing rather than fleeting...

That pretty much rules out about 2/3rds of your list, after that the number of connections looks normal for a web browser just generally "doing it's thing"

If you're curious then there is a neat tool Whois by IP Address which can tell you who onws a particular IP address range.

For example

96.6.172.20    -> Akamai Technologies, Inc (Webapp and download accelerators)
(same for most of the 96.16 - 96.17 range)  
Akamai Technologies, Inc. AKAMAI-200710 (NET-96-16-0-0-1) 96.16.0.0 - 96.17.255.255

74.125.226.140 -> Google (again)
Google Inc. GOOGLE (NET-74-125-0-0-1) 74.125.0.0 - 74.125.255.255

65.55.11.254   -> Microsoft (probably Windows Update)
Microsoft Corp MICROSOFT-1BLK (NET-65-52-0-0-1) 65.52.0.0 - 65.55.255.255

Take out those key players and all you are left with is a few general IP addresses for websites and stuff.

While having a bunch of connections like that running is vaguely odd, they are not uncommon these days with always-on internet as most people will not notice them and companies can get away with it.

I very much doubt you have a virus as the large proportion of connections are to reputable companies.

share|improve this answer
add comment

Try netstat -b from an elevated command prompt instead and it will tell you which programs are responsible for the connections.

Whilst possible, it is unlikely that a virus (or other malware) is responsible.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.