Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just found out by using TCPView that one of my svchost.exe had an http connection in "CLOSE_WAIT" to a strange IP address, although no other visible program was running.

With the help of Process Explorer I discovered that this svchost was using the WebClient Windows service.

I'm wondering how I can figure out what program used WebClient to connect to this IP, in order to determine if it's malware.

share|improve this question
    
What was the IP address? –  grawity Jan 16 '10 at 15:18
    
I don't think it's necessary to share it publicly. –  sork Jan 16 '10 at 21:41
    
How about proving the first two octets of the address (i.e. xxx.xxx of xxx.xxx.xxx.xxx)? –  boot13 Aug 22 '10 at 15:23
add comment

2 Answers

Well, you can find it out in this way:

  1. Find out the destination port it is visiting.
  2. Google the port and find out the related information, such as protocol, program.
  3. If it does not resolve your problem, analyze the packets in detail.
share|improve this answer
add comment

Webclient is a Microsoft service that allows Windows to access web-based files using an Explorer-like interface. It's not required unless you need WebDAV-like access to remote web sites. There's really no reason to suspect that it's malware. Have you considered just disabling the service? Here are some useful details.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.