Re: How to find process behing TCP connection ?

["Colin Copley" <colin.75 () btinternet com>]

Still not sure I quite understand, but if Process Explorer (v10.2?)  is
showing the process as "system 4" but not telling you the exe name right?,
try a right click and check out the threads tab in the properties dialog
box, perhaps this will point to any other dll's or exe's this process is
calling out to, if they are not system files then they could be known
malware dll's which might betray it.  Otherwise check out who is logged into
the box & from where.

----- Original Message ----- 
From: "Buozis, Martynas" <martynas () ti com>
Maybe I was not clear. Windows Server 2003 is acting as client and
initiates connection to service on port 139 too many workstations.
Actually it tries to logon as Administrator to many computers. And
process, that initiates connection, is "System 4". There are no reasons
why this server should connect to any of these workstations. Per
configuration attempt to logon as Admin is denied.

I set up open system and expect server will try to connect to it, so
maybe I will understand better what is behind activity, but I am also
sure, that more people got same problem for different reasons and they
are willing to share their experience.

So easy under Unix with LSOF and not possible under Windows ?... Can't
believe!

With best regards
Martynas


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------