Possible to find out what's using javaw.exe to connect outside the network?

Question

Is there any way to find out who/what is running something through java/javaw.exe, in order to determine if the outbound network connection is safe or rogue?

I use a third-party firewall (Windows Firewall Control) that interfaces with Windows 7's native firewall, and alerts me on any/all outbound connections (that don't already have a rule).

An issue, however, is javaw.exe -- because it's essentially a "gateway" program, it's not safe to allow it anytime/everytime/anyhow through the firewall.

So I'm wondering -- given no direct action or apparent cause-and-effect paired with an outbound network connection alert through javaw.exe, is there a way to determine what's doing the calling?

I'm also curious about this with svchost.exe, too.

Solution

Command-line arguments

A command-line argument or parameter is an item of information provided to a program when it is started. A program can have many command-line arguments that identify sources or destinations of information, or that alter the operation of the program.

When a command processor is active a program is typically invoked by typing its name followed by command-line arguments (if any).

_{Source: Command-line interface - Arguments}

By checking the full command-line string you can shed more light on the matter.

1. Open the Task Manager.
2. Select the Processes tab, then click View > Select Columns.
3. Enable the Command Line option, and click OK to apply the changes.

Further reading

• How to use the Windows Task Manager
• What do the Task Manager memory columns mean?

---

svchost.exe

The executable file is described as Host process for Windows Services. It's a generic process that hosts different system services.

There can be multiple instances of svchost.exe running on your computer, with each instance containing different services. One instance of svchost.exe might host a single service for a program, and another instance might host several services related to Windows. You can use Task Manager to view which services are running under each instance of svchost.exe.

1. Open Task Manager by right-clicking the taskbar, and then clicking Start Task Manager.

2. Click the Processes tab.

3. Click Show processes from all users. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

4. Right-click an instance of svchost.exe, and then click Go to Service(s). The services associated with the process are highlighted on the Services tab.

_{Source: What is svchost.exe?}

Comments

[and31415]

You can check the command line parameters, if you haven't already. Open the Task Manager and select the Process tab. Then click View > Select Columns and enable the Command Line option. As for svchost.exe, it's a generic host process name for system services. If you right-click it and choose Go to Service(s), all related services will be highlighted.

[lyrica]

@and31415 Ah, great idea! Thanks for the suggestion.

[lyrica]

@and31415 If you put that as an answer, I'll select it as best answer.