Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am running Windows 7 64-bit.

I can see which network connections are established by running netstat -anb. This tells me that there are a lot of connections established by "System".

Is there any way to drill down into this any more to determine why these connections exist?

share|improve this question
add comment

migrated from stackoverflow.com Nov 27 '12 at 22:37

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 1 down vote accepted

"System" is the Windows kernel, in some respect or another. From userspace, the Windows kernel is basically opaque, and you can't examine the behavior of its subsystems or drivers. It could be:

  • A device driver, such as a VPN or netfilt driver
  • Malware/virus/rootkit
  • Some kind of packet capturing software that has a kernel driver
  • Some system service that is moved into the kernel, maybe DRM for video playback

Depending on which remote hosts are being connected to, you should be able to determine if it's malicious or not. If it's just connecting to localhost or a local subnet (such as 127.x, 10.x or 192.x) I wouldn't worry about it. If it's connecting to remote hosts on the public Internet that you aren't familiar with, especially if they have domain names or a reverse DNS entry pointing at a domain name, you might worry, depending on what those domains are.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.