Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just found out by using TCPView that one of my svchost.exe had an http connection in "CLOSE_WAIT" to a strange IP address, although no other visible program was running.

With the help of Process Explorer I discovered that this svchost was using the WebClient Windows service.

I'm wondering how I can figure out what program used WebClient to connect to this IP, in order to determine if it's malware.

share|improve this question
What was the IP address? – grawity Jan 16 '10 at 15:18
I don't think it's necessary to share it publicly. – sork Jan 16 '10 at 21:41
How about proving the first two octets of the address (i.e. of – boot13 Aug 22 '10 at 15:23

Well, you can find it out in this way:

  1. Find out the destination port it is visiting.
  2. Google the port and find out the related information, such as protocol, program.
  3. If it does not resolve your problem, analyze the packets in detail.
share|improve this answer

Webclient is a Microsoft service that allows Windows to access web-based files using an Explorer-like interface. It's not required unless you need WebDAV-like access to remote web sites. There's really no reason to suspect that it's malware. Have you considered just disabling the service? Here are some useful details.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .