TheWiseGuy
Dog And Butterfly
Premium,MVM
join:2002-07-04
Yonkers, NY
| reply to Spooler
Re: ID Serve & Checking Automatic Update
said by Spooler:
Also turned AutoUpdates off & back on and rebooted.
I didn't need to reboot, I hit apply (WinXP Home) and it immediately checked for Updates, disabled it, waited a couple of minutes and selected "Notify me but..." again and it connected out again.
I believe PID 0 is normally System Idle process.
--
Dog and Butterfly |
|
BlitzenZeus
Burnt Out Cynic
Premium,MVM
join:2000-01-13
Beaverton, OR | PID 0 is actually a port waiting to timeout for its next use, the program that was listening is no longer bound to that port, and these are just past connections, however they do not show which program was listening. |
|
Spooler
@cableone.net
| WiseGuy and Zeus:
Thanks again. Sorry this turned into such a long dialog, but each post resulted in new learning (for me, at least).
----------------
Wise Guy:
I turned Windows Updates off and on without rebooting as you suggested. Kept TCPview on top to see what happened in real time. Three IP's appeared:
Two to MSFT at 64.4.23.156 which is ID'd as v5.windowsupdate.microsoft.com in my router logs.
And then one to 67.72.120.62 which is ID'd as "Footprint Distributor" by the GRC ID Serve utility you suggested.
That's a neat little tool. Thanks for recommending it.
--------------
BlitzenZeus:
Once again, you are right on from the start.
The exercises since your first post confirm the outbound to IP 67.72.4.94 is connected to MSFT Windows AutoUpdates using Level Three and what turned the third party servers - "Footprint".
TCPview caught it in action just as you said it would.
Thanks Everyone.
------------------
Mods - looks like we are done here with this one. |
|
bthielen
join:2004-11-15
| Check out
»headers.bragger.net/info/footpri···tor.html
Leads to sandpiper.net then this..
»www.cw.com/about_us/company_prof···_7a.html |
|
