Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I ran netstat -no and all these addresses came up:

http://i.stack.imgur.com/Kwnfz.png

I had just restarted my computer and nothing was even running except for the command prompt. I didn't even have a browser open and I keep my computer very clean and organized.

Do I have a virus? What's with all the active connections?

(Windows 7 64-Bit)

share|improve this question
3  
Note that TIME_WAIT is not "active"; it's the remains of a closed connection. Having many of these is normal when browsing the web. – grawity Sep 24 '11 at 11:39
up vote 7 down vote accepted

Picking one of the more common addresses at random (I chose 72.14.204.120) and putting it into a web browser appears to go straight to Google so I would have to say that the 72.14.204.XXX address range is pointing at Google and is most likely a result of the Google+ integration that is becoming more prevalent in every web page you visit. It seems that google want to keep a close eye on what you do these days and so their connections are ongoing rather than fleeting...

That pretty much rules out about 2/3rds of your list, after that the number of connections looks normal for a web browser just generally "doing it's thing"

If you're curious then there is a neat tool Whois by IP Address which can tell you who onws a particular IP address range.

For example

96.6.172.20    -> Akamai Technologies, Inc (Webapp and download accelerators)
(same for most of the 96.16 - 96.17 range)  
Akamai Technologies, Inc. AKAMAI-200710 (NET-96-16-0-0-1) 96.16.0.0 - 96.17.255.255

74.125.226.140 -> Google (again)
Google Inc. GOOGLE (NET-74-125-0-0-1) 74.125.0.0 - 74.125.255.255

65.55.11.254   -> Microsoft (probably Windows Update)
Microsoft Corp MICROSOFT-1BLK (NET-65-52-0-0-1) 65.52.0.0 - 65.55.255.255

Take out those key players and all you are left with is a few general IP addresses for websites and stuff.

While having a bunch of connections like that running is vaguely odd, they are not uncommon these days with always-on internet as most people will not notice them and companies can get away with it.

I very much doubt you have a virus as the large proportion of connections are to reputable companies.

share|improve this answer

Try netstat -b from an elevated command prompt instead and it will tell you which programs are responsible for the connections.

Whilst possible, it is unlikely that a virus (or other malware) is responsible.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .