Using Sysinternals and Wireshark to Check a Potentially Infected PC

Summary

The speakers recommend Sysinternals as a starting point for checking a Windows PC and show how Wireshark’s DNS filter can reveal network queries. They also discuss how Windows telemetry and third-party data collection complicate understanding where data goes.

Key points

• Sysinternals is recommended as a starting suite of tools for investigating a potentially infected Windows computer.
• Wireshark can monitor network traffic; filtering for DNS queries provides a more accessible view of requested domains and connections.
• The speakers describe a comparison of Windows XP and Windows 11, noting that current Windows traffic involves many more connections.
• They say some connections involve Microsoft telemetry and third-party data collectors, making it difficult to tell where data is going.

Vendors

Products

Tools

Related Articles

• Microsoft October 2026 Updates Fix 1,411 Flaws, Including Three Zero-Daysbleepingcomputer.comMicrosoft Windows · Sysinternals Suite
• Yarden Shafir Discusses Windows AI Agent Isolation and Security ResearchJohn HammondMicrosoft Windows · Wireshark
• Fortinet Details Evooo1Bot, a Modular Linux Botnet Targeting Internet-Facing Devicesfeeds.fortinet.comMicrosoft Windows · Wireshark
• Threat actors abuse Deno to run fileless malware in four intrusion casessophos.comMicrosoft Windows · Wireshark
• TAG-195 Evolves Its Malware-as-a-Service Toolkit with Four New Malware Familiesrecordedfuture.comMicrosoft Windows · Wireshark