The main malware variants (not to say almost all) need to establish a connection between the terminal and their command server. That means that with the right tools we can record that connection and obtain data such as IP address, hostname, and the process involved. Once again, developer Nirsoft has a small program called TcpLogView that automatically presents each connection and its secondary details.
Intuition can be a good ally when diagnosing a computer. At first glance you might not notice anything serious, but it is the accumulation of strange actions and "digital tantrums" that ends up exposing an infection. A good starting point is to monitor the connections that go out to the Internet.
Browsers, update systems, synchronization tools, and even Windows itself constantly generate links, however, all of them have a certain "profile" that differentiates them from a malicious process. Now the question is: How do we record this activity?
How to Watch and Monitor Your Connection
The answer is TcpLogView, another fabulous tool created by Nirsoft. At first the interface appears empty, which can convey the false idea of an error, but within seconds you will start to see the first entries. The information is divided into several columns, starting with date and time of the event, the type (opened or closed connection), local address, remote address, hostname, ports, process identifier, its full name, and the path of its location on the hard drive.
The last column resolves the country of the IP address, but it requires an additional download that is not under Nirsoft's control. As always, TcpLogView has no dependencies, is fully portable, and works on any version of Windows from Windows 2000 onwards.
If Windows decides to block its execution due to a permissions limit, it is enough to apply administrator privileges. To finish, I want to mention the possibility of exporting all the content to a text, HTML, CSV, or XML file, very useful if we need to perform a more detailed study.
