While debugging my web application in Fiddler, I found out that there are some suspicious requests to some hotel sites, search requests to google.pl. etc. See below images. Strangely there no process displayed in Fiddler.

Fiddler network packet trace Suspicious packet Fiddler network packet trace

It's definitely a virus. I don't know how to find out which software or process is causing it. Any help to further analyze and secure my system is highly appreciated.

  • Maybe other tools like microsofts network monitor show the process?
    – user78244
    Commented Jun 26, 2015 at 12:22
  • 3
    If your are using windows then try using the netstat -b to see what executable is making requests
    – ρss
    Commented Jun 26, 2015 at 12:50

4 Answers 4


You won't see a process if the request is not from the local machine, I.E., if you are allowing other machines to proxy via Fiddler. Check the Tools | Telerik Fiddler Options menu, and on the Connections tab, see if "Allow remote computers to connect" option is checked. If it is, this is likely where these requests are coming from, and why you can't identify the process they're associated with.


Microsoft's TCPView will show the link between processes and network connections:


  • 1
    used this, looks good however problem is that those connections closes very fast. by the time I observe and click on it it vanishes. Luckily I could click on one ( I think I did ) but it says system and PID is 0. also some says netbios
    – KA.
    Commented Jun 30, 2015 at 5:54

You can try:

netstat -abn

Which will show the process, if available.

You can also try:

netstat -aon

Which will show the PID which you can then lookup in the task manager.

However, it may not show up in either of those places depending upon how stealthy it is. If it doesn't show up there are techniques to use things like Logman logging Winsock activity, but it gets a little complicated from there.

  • Both commands dint give much info. probably because connections is not continuous it is connecting and closed in a split second.
    – KA.
    Commented Jun 30, 2015 at 5:51
  • 1
    For the time being, you could add an entry in your hosts file to route www.google.pl to until you can track this thing down.
    – k1DBLITZ
    Commented Jun 30, 2015 at 13:23
  • Good idea!. This will reduce one url :)
    – KA.
    Commented Jun 30, 2015 at 19:18

I would suggest Sysinternals: https://technet.microsoft.com/en-us/sysinternals/default.aspx.

These tools are good to have in your toolkit when investigating odd behavior:


TCPView will show you open connections and let you force close connections.


This program shows you programs that are set to start on boot and will let you remove them from autostarting. Windows has a number of places that programs can get injected to autostart.

Process Explorer and Process Monitor

These programs allow you to view running processes, ownership information, open files and open ports, dump memory owned by the process, and let you kill these programs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .