How can I scan Windows for malware?

Microsoft Defender can run Quick, Full and Offline scans, and PowerShell can be used to start scans and review Defender status.

Can Netstat detect malware?

Netstat can help investigate active network connections and process IDs, but it does not by itself prove that a process is malicious.

How can I check which process is using a network connection?

Netstat can show process IDs associated with network connections, and Task Manager, tasklist or PowerShell can be used to identify the corresponding process.

Windows Security & Malware Troubleshooting

Windows Security & Malware Troubleshooting Guides

Practical Windows security guides for Microsoft Defender, malware scans, suspicious processes, network connections, CMD, Netstat and PowerShell security troubleshooting.

Windows Security Guides

Microsoft Defender PowerShell Malware Scan

Update Defender security intelligence, run Quick Scan, Full Scan and Offline Scan, review detected threats and verify Defender protection status.

Read the Guide

Windows CMD Netstat malware investigation

Check Suspicious Connections with CMD & Netstat

Inspect active network connections, listening ports and process IDs when investigating suspicious Windows activity.

Read the Guide

Microsoft Defender Malware Scanning

Microsoft Defender is built into supported Windows systems and provides malware protection, security intelligence updates and multiple scan types.

PowerShell can be useful for administrators who want to check Defender status or run scans directly from the command line.

Windows Malware Investigation with CMD

Command Prompt can help investigate network activity and running processes when something appears unusual.

The goal is to collect evidence before making changes rather than assuming that every unknown process or connection is malicious.

Netstat Network Investigation

Netstat can display active TCP connections, listening ports, remote addresses, connection states and process IDs.

A commonly used diagnostic command is:

netstat -ano

The process ID can then be investigated using Task Manager, tasklist or PowerShell.

Find a Process by PID

If Netstat shows a process ID, you can identify the process using:

tasklist /FI "PID eq 1234"

Or with PowerShell:

Get-Process -Id 1234

Replace 1234 with the actual PID you are investigating.

Do Not Assume Every Unknown Connection Is Malware

Windows, browsers, cloud services, Microsoft applications, update services, security software and other legitimate programs make network connections.

Investigate the process name, executable path, publisher, digital signature and associated service before taking action.

Windows Security Search Topics

Windows malware scan
Microsoft Defender malware scan
Microsoft Defender PowerShell
PowerShell virus scan
PowerShell malware scan
Windows Defender Quick Scan
Windows Defender Full Scan
Windows Defender Offline Scan
Check Defender status PowerShell
Check detected threats Windows
Windows security commands
CMD malware check
Netstat malware check
Netstat Windows 11
Netstat Windows 10
Check suspicious connections Windows
Find process using network connection
Find PID with Netstat
Check listening ports Windows
Windows suspicious process
Windows hacker check
Windows network security
Windows Defender threat history

Windows Security Frequently Asked Questions

Can PowerShell scan Windows for malware?

Microsoft Defender exposes supported PowerShell commands that can update protection data, start scans and display Defender status information.

Can Netstat tell me if I have a virus?

No. Netstat shows network activity. It can help identify connections that need further investigation, but a security scanner and additional analysis are needed to confirm malware.

What does netstat -ano do?

It shows active connections and listening ports using numerical addresses and includes the process ID associated with each entry.

Should I kill an unfamiliar process?

Not automatically. First identify the executable path, publisher and service associated with the process. Legitimate Windows components can have unfamiliar names.