Analysis of Netstat | Defend the Web

NamasteMan
5 years ago

0

I have searched many hours about it but still have no real idea as to what I am looking at, have a gander here and suggest if you would be concerned or not:

C:\Windows\system32>netstat -ano

Active Connections

Proto Local Address TCP 0.0.0.0:135 TCP 0.0.0.0:445 TCP 0.0.0.0:1280 TCP 0.0.0.0:1281 TCP 0.0.0.0:1282 TCP 0.0.0.0:1283 TCP 0.0.0.0:1285 TCP 0.0.0.0:1286 TCP 127.0.0.1:1284 TCP 127.0.0.1:2833 TCP 127.0.0.1:2834 TCP 127.0.0.1:2872 TCP 127.0.0.1:2873 TCP 127.0.0.1:2874 TCP 127.0.0.1:2875 TCP 127.0.0.1:2878 TCP 127.0.0.1:2879 TCP 127.0.0.1:2888 TCP 127.0.0.1:2889 TCP 192.168.1.9:139 TCP 192.168.1.9:1038 TCP 192.168.1.9:2836 TCP 192.168.1.9:3156 TCP 192.168.1.9:3160 TCP 192.168.1.9:3162 TCP [::]:135 TCP [::]:445 TCP [::]:1280 TCP [::]:1281 TCP [::]:1282 TCP [::]:1283 TCP [::]:1285 TCP [::]:1286 TCP [::1]:1299 UDP 0.0.0.0:500 UDP 0.0.0.0:4500 UDP 0.0.0.0:5355 UDP 127.0.0.1:1900 UDP 127.0.0.1:52777 UDP 192.168.1.9:137 UDP 192.168.1.9:138 UDP 192.168.1.9:1900 UDP [::]:500 UDP [::]:4500 UDP [::]:5355 UDP [::1]:1900 UDP [::1]:52776 UDP [fe80::b171: Foreign Address State PID
0.0.0.0:0 LISTENING 900
0.0.0.0:0 LISTENING 4
0.0.0.0:0 LISTENING 652
0.0.0.0:0 LISTENING 1032
0.0.0.0:0 LISTENING 1064
0.0.0.0:0 LISTENING 1760
0.0.0.0:0 LISTENING 784
0.0.0.0:0 LISTENING 776
0.0.0.0:0 LISTENING 1948
127.0.0.1:2834 ESTABLISHED 1948
127.0.0.1:2833 ESTABLISHED 1948
127.0.0.1:2873 ESTABLISHED 1436
127.0.0.1:2872 ESTABLISHED 1436
127.0.0.1:2875 ESTABLISHED 4028
127.0.0.1:2874 ESTABLISHED 4028
127.0.0.1:2879 ESTABLISHED 4892
127.0.0.1:2878 ESTABLISHED 4892
127.0.0.1:2889 ESTABLISHED 2960
127.0.0.1:2888 ESTABLISHED 2960
0.0.0.0:0 LISTENING 4
40.67.254.97:443 ESTABLISHED 572
213.155.156.71:443 ESTABLISHED 1948
85.159.213.101:443 ESTABLISHED 1436
54.210.3.254:443 ESTABLISHED 1436
35.171.73.174:443 ESTABLISHED 1436
[::]:0 LISTENING 900
[::]:0 LISTENING 4
[::]:0 LISTENING 652
[::]:0 LISTENING 1032
[::]:0 LISTENING 1064
[::]:0 LISTENING 1760
[::]:0 LISTENING 784
[::]:0 LISTENING 776
[::]:0 LISTENING 5136
: 1064
: 1064
: 1564
: 1812
: 1812
: 4
: 4
: 1812
: 1064
: 1064
: 1564
: 1812
: 1812
8bed:1a66:5f18%3]:1900 : 1812

Went to the end of reality and back, remote neural monitoring is deep.

dloser
5 years ago

0

Try running it with the option -b as well. The -o option is useful if you have a look on the system itself to find which process belongs to which pid. We cannot, unless we have hacked your system. ;)

The only things that seem a bit peculiar are the ports 128x and 28yz. Could be some virusscanner or firewall or something. 213.155.156.71 seems to have belonged to Kaspersky, so that would probably explain it.

NamasteMan
5 years ago

0

Yeah I thought as much, the lap top I use is all over the place at the moment, I am a complete newbie lol. I have started taking great delight in “tinkering”, the most recent one that has cropped up is the time indifference.

Running SQL and it fails in the logs it shows an hour time difference, it also does that same with online radio shows. It’s like everything is an hour ahead? Weird huu? So on the display it shows the current time of 11:32 in the uk 01/11/2018, yet in my SQL log it show the time as 12:32 in the uk 01/11/2018. I have got netsynce installed and also have checked the bios time also also CMD shows the time at 11:33.
Is this something else I should also be worried about do you recon?

Also thank’s for the response dude

Went to the end of reality and back, remote neural monitoring is deep.