Is There Spyware on Your PC? 7 Built-in Commands That Show Who Is Connecting to the Internet
Every program that sends data out has to open a connection — and Windows lets you see each one, with the name of the program behind it. Learn to read netstat, Get-NetTCPConnection and Resource Monitor, and to hunt down remote access tools and hidden scheduled tasks.
The investigation in 5 steps:
- Active connections with the program name:
Get-NetTCPConnectionornetstat -abno. - Where each program lives:
Get-Processwith the file path — spyware loves temporary folders. - What starts with Windows: startup programs and scheduled tasks.
- Remote access tools installed without your knowledge: AnyDesk, TeamViewer and the like.
- Found something? Disconnect from the internet, run Defender’s offline scan and change passwords from another device.
- Introduction
- Who Is Connected Right Now: Get-NetTCPConnection
- The Classic netstat -abno
- Where Each Program Comes From: the Path Gives Away the Spy
- Resource Monitor: Who Is Using the Internet
- What Starts with Windows
- Hidden Scheduled Tasks
- Remote Access Programs You Didn’t Install
- Finding Out Where a Connection Goes
- Who Used Your Camera and Microphone
- I Found Something Suspicious: Do This, in Order
- A 5-Minute Monthly Routine
- Things That Look Suspicious but Are Normal
- Frequently Asked Questions
🕵️ Every Spy Needs to Talk to Someone
Spyware, a remote access trojan or a hidden crypto miner all have one thing in common: they need to communicate over the internet — to send your passwords, receive commands or ship what you type. And every communication leaves a trail: a network connection opened by a program, with a destination address.
Windows shows these connections for free, with the name of the program responsible. You don’t need to be technical: you just need to know what’s normal to notice what isn’t.
| Symptom | May indicate |
|---|---|
| Webcam light turns on by itself | A program accessing the camera |
| The mouse moves or windows open by themselves | Active remote access |
| Fans at full speed with the PC idle | A crypto miner |
| Slow internet even with nothing in use | A program sending or downloading data |
| Friends get messages you didn’t send | A hacked account (not always the PC) |
🌐 Who Is Connected Right Now: Get-NetTCPConnection
This command lists established connections and shows each one’s program name:
Get-NetTCPConnection -State Established | Select-Object RemoteAddress, RemotePort, OwningProcess, @{n='Program';e={(Get-Process -Id $_.OwningProcess).ProcessName}} | Sort-Object Program | Format-Table -AutoSize
| Column | What it means |
|---|---|
| RemoteAddress | The IP address on the other end of the connection |
| RemotePort | The port used: 443 is HTTPS (websites), 80 is HTTP; odd high ports deserve attention |
| OwningProcess | The process number (PID) |
| Program | The name of the program responsible |
It’s normal to see the browser (chrome, msedge, firefox), OneDrive, Teams, WhatsApp, Spotify, Windows services (svchost) and the antivirus. Note any name you don’t recognize.
📋 The Classic netstat -abno
netstat is the oldest command for this and shows even connections that are just “listening”, waiting for someone to connect from outside:
netstat -abno| Option | What it does |
|---|---|
| -a | Shows all connections and open ports |
| -b | Shows the executable name (requires administrator) |
| -n | Shows numbers instead of names (faster) |
| -o | Shows each connection’s PID |
Pay attention to lines in the LISTENING state on programs that aren’t part of Windows: a program waiting for connections from outside is typical of remote access.
📁 Where Each Program Comes From: the Path Gives Away the Spy
A common malware trick is using a name similar to a legitimate program (svch0st.exe, chrome_update.exe). The file path unmasks it:
Get-Process | Where-Object Path | Select-Object ProcessName, Id, Path | Sort-Object Path | Format-Table -AutoSize
| Path | Assessment |
|---|---|
| C:\Windows\System32\… | Normal for Windows programs |
| C:\Program Files\… or C:\Program Files (x86)\… | Normal for installed programs |
| C:\Users\YourName\AppData\Local\… for well-known apps (Teams, Discord, WhatsApp) | Normal |
| …\AppData\Local\Temp\… or …\AppData\Roaming\ with a strange name | 🔴 Suspicious |
| C:\ProgramData\ with a random name (e.g. xk29dj.exe) | 🔴 Suspicious |
| svchost.exe outside C:\Windows\System32 | 🔴 Almost certainly malware |
Found a strange process? Note its number (Id) and compare it with the OwningProcess from Command 1’s connections.
📊 Resource Monitor: Who Is Using the Internet
If you prefer something visual, Windows has Resource Monitor:
resmon- Open the Network tab.
- Under Processes with Network Activity, sort by Total (B/sec).
- Under TCP Connections, see where each program is sending data.
An unknown program at the top of the list while the PC is idle is the biggest warning sign — it’s sending or receiving lots of data without you asking.
🚀 What Starts with Windows
A spy that doesn’t survive a restart is useless — so almost all of them add themselves to startup:
Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location | Format-ListAlso check Task Manager’s Startup apps tab. To understand what you can safely turn off, follow how to disable startup programs.
⏰ Hidden Scheduled Tasks
Smarter malware uses Task Scheduler to run from time to time. This command lists tasks that aren’t Microsoft’s:
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike '\Microsoft*' } | Select-Object TaskName, TaskPath, State | Format-Table -AutoSizeIt’s normal to see update tasks for browsers, OneDrive, graphics drivers and programs you installed. Be suspicious of generic names (“SystemUpdate”, “WindowsHelper”) or random strings. To see what a task runs:
(Get-ScheduledTask -TaskName 'TaskName').Actions🖥️ Remote Access Programs You Didn’t Install
AnyDesk, TeamViewer and similar tools are legitimate — and the favorites of scammers posing as “bank support”. If one of them is installed and you don’t remember installing it, that’s a red flag:
Get-Process | Where-Object { $_.ProcessName -match 'anydesk|teamviewer|rustdesk|ultraviewer|ammyy|screenconnect|supremo' } | Select-Object ProcessName, Path
If something shows up, check whether it’s set to accept connections without confirmation (“unattended access”) and uninstall it if you don’t use it. The most common scam that installs these programs is the fake tech support scam.
🔎 Finding Out Where a Connection Goes
Found a strange program connected to an IP? You can get an idea of who owns the address:
Resolve-DnsName 142.250.0.1 -ErrorAction SilentlyContinueIf the resolved name belongs to a well-known company (google, microsoft, amazonaws, cloudflare), that doesn’t mean it’s safe — malware also uses public clouds — but the program that opened the connection is what really matters. A legitimate program talking to Microsoft is normal; an unknown executable in the Temp folder talking to anywhere is not.
🎥 Who Used Your Camera and Microphone
Windows 11 keeps a history of which apps accessed the camera, the microphone and location. Go to Settings → Privacy & security → Camera (and then Microphone) and scroll to Recent activity: it shows the apps and the time of last access.
| What appears | Assessment |
|---|---|
| Teams, Zoom, WhatsApp or the browser at the time of a call | Normal |
| An unknown app accessing it in the middle of the night | 🔴 Investigate with the commands above |
| Access at a time when the PC was left alone | 🔴 Suspicious |
While you investigate, turn off camera and microphone access for apps that don’t need it — and for an extra physical layer, a sticker or slider cover on the webcam does the job.
🆘 I Found Something Suspicious: Do This, in Order
- Disconnect from the internet (cable or Wi-Fi) to cut the communication.
- Don’t delete files by hand yet — let the antivirus remove them properly.
- Run Microsoft Defender’s offline scan (the PC restarts and scans before Windows loads):
Start-MpWDOScan- From another device, change your email, bank and social media passwords, and turn on two-step verification.
- Sign out of open sessions in your accounts (Google, Microsoft, social media) under “Connected devices”.
- If the problem continues, back up only your documents and reinstall Windows from scratch.
To see whether someone physically used your PC, complement this with how to find out if someone used your PC, and to check your accounts, devices connected to your accounts. Next time, test doubtful programs in the Windows Sandbox first.
🗓️ A 5-Minute Monthly Routine
- Run Command 1 and check for unknown connected programs.
- Run Command 3 and look for executables in Temp or ProgramData folders.
- Open Task Manager → Startup apps and disable what you don’t recognize.
- Check the camera and microphone Recent activity.
- Make sure Defender is up to date with real-time protection on.
Take a screenshot the first time you do this with a clean PC: in the following months it’s much easier to spot what’s new.
😌 Things That Look Suspicious but Are Normal
| What you see | Why it’s normal |
|---|---|
| Dozens of svchost.exe connections | It’s the “host” for many Windows services (if it’s in System32) |
| The browser connected to companies you didn’t visit | Sites load ads, fonts and analytics from other companies |
| MsMpEng.exe connected | That’s Microsoft Defender downloading updates |
| OneDrive, Teams and WhatsApp always connected | They keep syncing messages and files |
| Ports like 135, 139 and 445 listening | Standard Windows network services |
FAQ
How do I see which programs are using the internet?
In PowerShell, use Get-NetTCPConnection with the process name, as shown in the guide, or open resmon and check the Network tab.
What is netstat -abno?
It’s a command that lists all connections and open ports, with the executable name and process number. It must be run as administrator.
How do I know if a process is malware?
Check the file path with Get-Process. Legitimate programs live in System32 or Program Files; oddly named executables in Temp or ProgramData folders are suspicious.
Is having AnyDesk installed dangerous?
Not if you installed and use it. It’s dangerous when it appears without your knowledge, because scammers use it to control PCs remotely.
Is svchost.exe a virus?
The real one lives in C:\Windows\System32 and is normal. An svchost in any other folder is almost certainly malware.
What should I do if I find spyware?
Disconnect from the internet, run Defender’s offline scan with Start-MpWDOScan and change your passwords from another device.
My webcam light turned on by itself. Is it spyware?
It could be a legitimate app using the camera, like a video call. Check Settings, Privacy & security, Camera to see which apps accessed it recently.
Do these commands change anything?
No. They only read information. The only one that changes something is Start-MpWDOScan, which restarts the PC to run the scan.
🎮 How much did you learn?
Once you pick an answer it locks in — reload the page to try again.
1. Why does spyware leave a trail on the network?
2. Which path is suspicious for a program?
3. Which visual tool shows who’s using the internet?
4. What’s the first thing to do when you find something suspicious?
5. Which command runs Defender’s offline scan?
Esse conteúdo ajudou você?
Compartilha com alguém que também vai curtir — é rapidinho e ajuda muito o nosso trabalho a chegar em mais gente.
Conhecimento só tem valor quando compartilhado.
Manter essa estrutura de laboratórios funcionando e produzir conteúdos de engenharia de forma totalmente gratuita e acessível exige tempo e dedicação diária à bancada. Esse guia salvou os seus arquivos? Você pode contribuir diretamente para manter o nosso trabalho independente forte. Apoie doando qualquer valor!
Quer apoiar a nossa bancada independente?
[email protected]
