View Full Version : netstat help
July 12th, 2002, 08:58 PM
i ran netstat as i do now and then and iv noticed a number of suspect conections
one that has just come up now is this
tcp 1060 staticline420.toya.net.pl:1214 fin_wait_2
and id like to know what conections like this are
is this possable evidence of infection by eather spy tec or a trojen ??
July 12th, 2002, 09:20 PM
No..It is normal to see at times.
July 13th, 2002, 06:18 PM
hi thanks for ya reply
ok just to clarify
when i run netstat how do i tell whats a normal conection to the web and somthing suspect that i need to be concerned about ??
July 14th, 2002, 03:20 PM
Hi Brethrezen: That can be a challenge, but as you become familiar with what applications connect and what ports they associate with, it will beome a matter of elimination. Some include AV and other software you have set for automatic updating. For instance, assuming Iíve closed my browser from the internet, am free of spyware and have all updates set to manual, the only remote connection I expect to see established is my e-mail program connecting to my ISPís mail server to check for mail. Another process I might expect to see is my AVís e-mail scrubber. I also use a free little utility called Active Ports: http://www.ntutility.com/?from=prog_aports (For Win2K/NT/XP) that combines features of netstat and process lists, helping me determine what applications (by their path) are using what ports and port status, i.e., Listening or Time_Wait. If your platform doesnít support this, others always have suggestions.
I routinely check netstat after closing from the net and sometimes find connections hanging on, temporary but I kill Ďem anyway just be sure. Frequenting Wilders has provided many useful links, ideas, awareness and applications. Itís a primary reason why nothing gets in or out of my system without legitimate reason. Probably time to shoot Paul e-mail about membership. Registered in February, but always shows me as a guest. Wonít let me re-register, saying my e-mail address is already in use. Best Regards, Rick
July 14th, 2002, 03:45 PM
CTL-ALT-DEL and look at processes = Filenames
START, RUN, MSCONFIG and look at Services
These two are NOT showing the same info
vBulletinģ Copyright ©2000-2013, Jelsoft Enterprises Ltd.
Copyright ©2002 - 2013, Wilders Security Forums