It all start when my firewall administrator start to monitor their logs. They found that one of my webserver is attempting to make a connection to the internet at random times. It shows that the webserver attempts to connect using http to 58.27.86.128, 58.27.86.113, 65.55.11.179. As the firewall has block it, the connection was not successful. I'm trying to figure which process is attempting the connection. I uses netstat -n - b and manage to find out that it was due to W3WP.exe. However I'm not sure what the next step, I'm hoping that I can find the application making the connection so that I can turn it off. Bun

You can use Process Explorer and Process Monitor to find W3WP.exe location. I think other Sysinternals Tools maybe help you.Mohammad Javad Bagdeli

I'm not very good at both. I tried Process Monitor and it shows me that W3WP.exe is the one making the connection and it comes from the default pool. Hope I interpret the result correctly but is does not help me to know which aspx module is making the connection call. Anyone knows what's these IP 58.27.86.128, 58.27.86.113, 65.55.11.179 is for or sees these connection in their system?

Our company servers also found the invalid traffic to 58.27.86.128 and 58.27.86.113 through TCP. Process monitor also shown me that w3wp.exe make the connection. I setup a new server and install the component one by one and found Dotnet framework trying to make the connection. I installed wireshark to capture TCP traffic. Then, I install Dotnet Framework 2.0 x86 and wireshark immediately shown the traffic to 58.27.86.128 and 58.27.86.113. I download Dotnet Framework 2.0 x86 from Microsoft website and reinstall, the result still same.