How to Check for Malware Using CMD & Netstat on Windows
Learn how to inspect active network connections, listening ports and process IDs from Windows Command Prompt when investigating unusual network activity or a potentially suspicious process.
Published: December 1, 2024
Investigate Suspicious Network Activity with CMD
Windows includes built-in networking commands that can help you investigate which connections are currently active on a computer.
Netstat is particularly useful because it can display local ports, remote addresses, connection states and process IDs.
- Active Connections
- Listening Ports
- Process IDs
1. Check Connections with netstat -ano
Open Command Prompt and run:
This displays active TCP connections, listening ports and the PID associated with each entry.
2. Understand the Netstat Results
The output can contain information such as:
- Protocol
- Local Address
- Local Port
- Foreign Address
- Remote Port
- Connection State
- PID — Process ID
Common TCP states include ESTABLISHED, LISTENING, TIME_WAIT and CLOSE_WAIT.
3. Identify the Process Behind a Connection
After finding a PID in the netstat output, you can identify the corresponding process.
Replace 1234 with the PID you want to investigate.
You can also check the PID from Task Manager.
4. Check the Process with PowerShell
PowerShell provides another way to inspect a process by PID:
Replace 1234 with the actual process ID.
A Network Connection Does Not Automatically Mean Malware
Windows, browsers, cloud applications, antivirus software, Microsoft services, update services and many legitimate applications communicate over the network.
Do not delete files or terminate important Windows services simply because they appear in netstat.
5. Investigate an Unknown Process
If you do not recognize a process, check:
- The exact process name
- The executable file path
- The process publisher
- Its digital signature
- The service associated with the PID
- The remote address it is communicating with
- Whether Microsoft Defender reports a threat
6. Scan Suspicious Activity with Microsoft Defender
Netstat is an investigation tool rather than an antivirus scanner. If you suspect malware, use Microsoft Defender or another trusted security product to scan the computer.
UniTech LK also has a separate PowerShell guide covering Microsoft Defender Quick Scan, Full Scan, Offline Scan, threat history and Defender status.
Microsoft Defender PowerShell Scan GuideWindows CMD & Netstat Troubleshooting Topics
This guide is relevant to Windows searches such as:
- Check network connections CMD
- Netstat Windows 11
- Netstat Windows 10
- Netstat malware check
- Check suspicious connections Windows
- Find process using network connection
- Find PID with netstat
- Netstat -ano explained
- Check listening ports Windows
- CMD network security commands
- Find suspicious process Windows
- Check active connections Windows
- Windows malware investigation
- Microsoft Defender malware scan
CMD & Netstat Frequently Asked Questions
Can netstat find a hacker?
Netstat can show network connections and the local processes associated with them. It cannot by itself determine that a remote connection belongs to a hacker.
Can netstat detect a virus?
No. It can help expose network activity for investigation, but malware detection requires additional analysis and security tools.
What does the PID in netstat mean?
PID means Process ID. Windows assigns a process ID to each running process, allowing you to connect a network entry to a running application or service.
Should I kill an unknown PID?
Not immediately. Identify the process and its file path first. Important Windows services can also appear under unfamiliar process names or service hosts.
Related UniTech LK Security Guides
Watch the CMD + Netstat Tutorial
Watch the complete 1 minute 2 second UniTech LK video demonstrating the Windows CMD and netstat investigation method.
Watch on YouTube