Chris Angelico wrote, on Saturday, March 25, 2017 1:53 AM > > On Sat, Mar 25, 2017 at 7:41 PM, Ho Yeung Lee > <jobmatt...@gmail.com> wrote: > > TCP 127.0.0.1:1663 127.0.0.1:28091 > ESTABLISHED 9900 > > TCP 127.0.0.1:28091 127.0.0.1:1663 > ESTABLISHED 9532 > > > > above two process connect to itself, named ismagent and updateui.exe > > > > are they the malware software? > > > > > > TCP 127.0.0.1:1663 127.0.0.1:28091 > ESTABLISHED 9900 > > TCP 127.0.0.1:7496 0.0.0.0:0 > LISTENING 7496 > > TCP 127.0.0.1:27015 0.0.0.0:0 > LISTENING 9968 > > TCP 127.0.0.1:28091 0.0.0.0:0 > LISTENING 9532 > > TCP 127.0.0.1:28091 127.0.0.1:1663 > ESTABLISHED 9532 > > TCP 127.0.0.1:43227 0.0.0.0:0 > LISTENING 3772 > > TCP 127.0.0.1:50000 0.0.0.0:0 > LISTENING 9532 > > TCP 192.168.1.102:1128 210.176.156.35:443 > FIN_WAIT_2 5124 > > TCP 192.168.1.102:1509 64.233.188.102:443 > ESTABLISHED 6700 > > TCP 192.168.1.102:1510 216.58.203.46:443 > ESTABLISHED 6700 > > TCP 192.168.1.102:1511 216.58.203.46:443 > ESTABLISHED 6700 > > TCP 192.168.1.102:1512 216.58.200.5:443 > ESTABLISHED 6700 > > TCP 192.168.1.102:1513 172.217.26.195:443 > ESTABLISHED 6700 > > TCP 192.168.1.102:1514 172.217.26.195:443 > CLOSE_WAIT 6700 > > TCP 192.168.1.102:1898 111.221.29.156:443 > ESTABLISHED 1544 > > This question is about systems administration and has nothing > to do with Python. > > To figure out what each connection represents, you'll have to > figure out what programs are on the two ends. (In the case of > listening sockets, figure out which program is listening.) > Then research what's actually being done by those programs. A > simple dump like this is not going to tell you much about > whether it's malware. > > ChrisA
You can also look up the IP addresses with a DNS lookup tool that aren't your machine (127.0.0.1 and 192.168.1.102). This may be helpful if you recognize who they are, or you can google the IP addresses and/or their owners. If they're malware, Google will have lots of pages on them. This looks like a readout from Essential Net Tools running in Express mode. If you select Addvanced mode, ENT will tell you the process name and lots of other good stuff for each entry, plus ENT is a full network toolbox and you won't need Google. Deborah -- https://mail.python.org/mailman/listinfo/python-list
