dandelion
Premium,MVM
join:2003-04-29
Germantown, TN
clubs:
 ·Comcast
| reply to dandelion
Re: How to find which program is trying to get online?
Thanks so much!! Finally got it, here's the fport-if I'm interpreting right it's saying my Earthlink Total Access trying to get online??? But that HAS permission from ZA to get online, so I may not be interpreting right-what do you think??
FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
»www.foundstone.com
Pid Process Port Proto Path
1128 tcpsvcs -> 7 TCP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 9 TCP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 13 TCP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 17 TCP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 19 TCP C:\WINDOWS\System32\tcpsvcs.exe
596 svchost -> 135 TCP C:\WINDOWS\system32\svchost.exe
4 System -> 445 TCP
632 svchost -> 1025 TCP C:\WINDOWS\System32\svchost.exe
4 System -> 1026 TCP
632 svchost -> 3002 TCP C:\WINDOWS\System32\svchost.exe
632 svchost -> 3003 TCP C:\WINDOWS\System32\svchost.exe
2036 winFAH -> 3167 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 3332 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 3443 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 3602 TCP C:\Program Files\Accessories\winFAH.exe
3192 TaskPanl -> 3648 TCP C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
2036 winFAH -> 3659 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 3808 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 4378 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 4454 TCP C:\Program Files\Accessories\winFAH.exe
632 svchost -> 4707 TCP C:\WINDOWS\System32\svchost.exe
632 svchost -> 4714 TCP C:\WINDOWS\System32\svchost.exe
2036 winFAH -> 4734 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 4908 TCP C:\Program Files\Accessories\winFAH.exe
796 -> 5000 TCP
3192 TaskPanl -> 8097 TCP C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
1128 tcpsvcs -> 7 UDP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 9 UDP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 13 UDP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 17 UDP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 19 UDP C:\WINDOWS\System32\tcpsvcs.exe
2036 winFAH -> 123 UDP C:\Program Files\Accessories\winFAH.exe
596 svchost -> 445 UDP C:\WINDOWS\system32\svchost.exe
4 System -> 500 UDP
3192 TaskPanl -> 1900 UDP C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
2036 winFAH -> 1900 UDP C:\Program Files\Accessories\winFAH.exe
632 svchost -> 3011 UDP C:\WINDOWS\System32\svchost.exe
4 System -> 3039 UDP
2036 winFAH -> 3040 UDP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 4300 UDP C:\Program Files\Accessories\winFAH.exe
this is one of the alerts I get from ZA:
a73bc66a95cf4f7b597fc8975778a889
The MD5 hash, or number, that
uniquely identifies the
executable.
Date Modified
May-11-2003 08:12:10 PM The date
when explorer.exe was most
recently modified.
Connect Type
Access This value can be either
Access, which is an Internet
connection attempt by Windows
Explorer or Server, which
indicates that Windows Explorer
is waiting for connections coming
in from the Internet.
Remote
Port 1900 The port Windows
Explorer is using on the remote
computer. |
