OK, now that I'm getting acquainted with all of my cool new Diamond software, I have some questions. I figure the PE forum might be a good place to ask about what PE shows. Here are listening processes I'd like to know more about: Generic Host Process... PID: 816; TCP; Local: 0.0.0.0 on 135; Remote 0.0.0.0 on 0 Generic Host Process... PID: 956; TCP; Local: 0.0.0.0 on 1025; Remote: 0.0.0.0 on 0 Generic Host Process... PID: 1092; UDP Local: 0.0.0.0 on 1027; Remote: *.*.*.* on * * SYSTEM PID: 4; TCP; Local 0.0.0.0 on 445; Remote 0.0.0.0 on 0 * SYSTEM PID: 4; TCP; Local 0.0.0.0 on 445; Remobe *.*.*.* on * I think I understand LSA Shell and the other stuff that shows up. I'm most puzzled about this Svchost generic host process mishmash listening on local ports TCP 1025 and UDP 1027. Is this normal and what is it? I've already managed to shut down some other NetBIOS stuff that was listening on two other ports. I could've sworn that I'd already turned NetBIOS off, so, I found looking at the ports to be pretty useful!