Re: How to find process behing TCP connection ?

Still not sure I quite understand, but if Process Explorer (v10.2?) is
showing the process as "system 4" but not telling you the exe name right?,
try a right click and check out the threads tab in the properties dialog
box, perhaps this will point to any other dll's or exe's this process is
calling out to, if they are not system files then they could be known
malware dll's which might betray it. Otherwise check out who is logged into
the box & from where.

----- Original Message -----
From: "Buozis, Martynas" <martynas@xxxxxx>
Maybe I was not clear. Windows Server 2003 is acting as client and
initiates connection to service on port 139 too many workstations.
Actually it tries to logon as Administrator to many computers. And
process, that initiates connection, is "System 4". There are no reasons
why this server should connect to any of these workstations. Per
configuration attempt to logon as Admin is denied.

I set up open system and expect server will try to connect to it, so
maybe I will understand better what is behind activity, but I am also
sure, that more people got same problem for different reasons and they
are willing to share their experience.

So easy under Unix with LSOF and not possible under Windows ?... Can't
believe!

With best regards
Martynas


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------

Relevant Pages

  • Re: How to find process behing TCP connection ?
    ... I used command "netstat -abov" ... TCP connections from server to many computers! ... EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE ... The NSA has designated Norwich University a center of Academic Excellence in Information Security. ...
    (Security-Basics)
  • RE: Opinions on vulnerability scanning practice?
    ... I'd like to get a community opinion on this. ... management firm run a vulnerability scan on our server, ... Norwich University ... EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE ...
    (Security-Basics)
  • RE: blocking file formats in the interior of the network
    ... If you are running Windows 2003 server R2 you can use the File Server ... EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE ... The NSA has designated Norwich University a center of Academic ... Our program offers unparalleled Infosec management ...
    (Security-Basics)
  • Re: Draytek Router Passwords
    ... EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE ... The NSA has designated Norwich University a center of Academic Excellence ... Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. ...
    (Security-Basics)
  • RE: Deny client from obtaining IP address
    ... Radius backend server with the TLS protocol authentication method or mac ... LOL I use the 802.1 to lock down our ... EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE ... The NSA has designated Norwich University a center of Academic Excellence ...
    (Security-Basics)