As shown in figure:

Hope to know friends some directions!
Thank you very much!

CodePudding user response:

Netstat - nb and see which process is to establish the session

CodePudding user response:

[svchost. Exe)
TCP 121.201.0. * * * : 12489 115.159. * * *. 74:35003 TIME_WAIT
TCP 121.201.0. * * * : 12489 115.159. * * *. 74:35004 TIME_WAIT

CodePudding user response:

I put the content to export, as shown in the above

CodePudding user response:

At the back of the is the same, the trouble to help have a look at the
thank you

CodePudding user response:

Svchost. Exe always occupy the connection is established, it is possible that the virus
Several methods:
1. Input wmic in "run" dialog box, enter in the window "process" can quickly see all svchost. Exe process path, see if there are any suspicious path, it is usually the WINDOWS of the SYSTEM32 folder, if there is a suspicious, antivirus

(2), type the command in the command prompt: netstat aon | findstr searches "12489", press enter, write down the last of a string of Numbers, the PID. Then start task manager TAB, in the process to make it show the process of PID (Windows 7 in view, column selection; WIN10 directly by right-clicking in the title bar), to find just the PID of the corresponding process, try to end it,

CodePudding user response:

Thank you very much!
This seems to be a BUG, now can only be patched restart,
https://support.microsoft.com/zh-cn/kb/2553549