How to know which program is using the WebClient service?
- by sork
Hello,
I just found out by using TCPView that one of my svchost.exe had an http connection in "CLOSE_WAIT" to a strange ip address, although no other visible program was running.
With the help of Process Explorer I discovered that this svchost was using the WebClient windows service.
I'm wondering how I can figure out what program used WebClient to connect to this ip, in order to determine if it's malware.