Possible Trojan

[Vasko]

When I run netstat.exe I see an established connection
with certain IP adress. I suspect that it is being created
by a Trojan. Unfortunatel so far I have been unable to
locate the process / program creating that connection. I
run Win2000 with all Service Packs and Hot Fixes
installed. Can you please help me locate the problem or at
least terminating the connection to that IP Adress.

Vassil Velev

 

[JasonW]

Get a free program called Fport from Foundstone:
http://www.foundstone.com/ (Resources, Free Tools)
It will list the same info as netstat, but also the path to the program
using that port.

-JasonW

 

[Karl Levinson [x y] mvp]

Agreed. Additionally, antivirus with the latest updates and/or
http://housecall.antivirus.com would be helpful. www.grisoft.com is free
antivirus. A firewall would also help. www.kerio.com and www.sygate.com
are two free firewalls. Here are some other things that might help track
down intrusions on your system:

http://securityadmin.info/faq.htm#hacked
http://securityadmin.info/faq.htm#re-secure
http://securityadmin.info/faq.htm#harden

 

[Vasko]

Thank you Jason and Karl. It helped a lot.
I found the program creating that connection and it wasn't
virus. Thanks

-----Original Message-----
Agreed. Additionally, antivirus with the latest updates and/or
http://housecall.antivirus.com would be helpful.

www.grisoft.com is free