Along with many other factors excessive network activity can be indirect or direct evidence that a computer is infected. Firstly, we need to find out which network activity is normal and which one is excessive. It will be something special for different users, but in any case the representation of the normal network activity can be obtained only on a machine known clean. Let’s consider the general case, it will help us to understand how to identify network activity. There are many tools for network activity analysis, ranging from the simplest like TCPView to firewalls built into anti-virus products, which allow you to track network activity online. There is a built-in utility called "netstat" in Windows family of operating systems. It can be launched right from a console. The netstat.exe utility is used. It is a free Windows utility. Keywords: trojan, worm, virus, malware, detect malware, remove malware.