dandelion
Premium,MVM
join:2003-04-29
Germantown, TN
clubs: | reply to dandelion
Re: How to find which program is trying to get online?
I don't understand creating batch file sorry, is there another way to slow it down so I can see? or maybe another program that does same but viewable? |
|
2kmaro
Think
Premium,ExMod 1 BC
join:2000-07-11
ColossalCave
clubs: 
| Use Notepad to create the batch file (or just enter the first line of command in a command window as
fport > fport.txt
What that says is to start the program fport.exe and send all output to a text file named fport.txt
If you create that with notepad and save it as launch.bat then it saves you having to retype the fport > fport.txt command each time, just open a command window and go to that folder and type launch. If you use two > symbols, as fport >> fport.txt, then the "log" for each execution will be appended to the fport.txt file.
Then you can use Notepad to open up the fport.txt file to see what is in it.
--
Good judgment comes from experience, and experience comes from bad judgment. Barry LePatner |
|
Randy Bell
Premium
join:2002-02-24
Santa Clara, CA
3 edits | reply to dandelion
said by dandelion  :
I don't understand creating batch file sorry, is there another way to slow it down so I can see? or maybe another program that does same but viewable?
1. Open Notepad
2. Enter "CD {Fport_Path}" {without quotes}
3. Enter "fport > fport.txt" {without quotes}
4. File, Save As: "launch.bat" {with quotes}
In Step 4; File, Save As: -- choose "All files" and save as "launch.bat" {with quotes} -- the quotes tell Notepad *NOT* to append a .txt or any other extension -- the saved file must have a .bat extension.
In Step 2, {Fport_Path} is the specific folder {complete path} you put the fport program in. The "CD" is a "change directory" command, that tells it to go to that folder where fport is located.
If you save "launch.bat" to your Windows directory, it will be accessible at all times by typing "launch" from the Command Prompt. This is because Windows directory is part of the environment "path" that is always searched first for executable programs. Hope that helps. 
--
"But now abide faith, hope, love, these three; but the greatest of these is love." (1 Cor. 13:13) |
|
dandelion
Premium,MVM
join:2003-04-29
Germantown, TN
clubs:
 ·Comcast
| reply to dandelion
Thanks so much!! Finally got it, here's the fport-if I'm interpreting right it's saying my Earthlink Total Access trying to get online??? But that HAS permission from ZA to get online, so I may not be interpreting right-what do you think??
FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
»www.foundstone.com
Pid Process Port Proto Path
1128 tcpsvcs -> 7 TCP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 9 TCP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 13 TCP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 17 TCP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 19 TCP C:\WINDOWS\System32\tcpsvcs.exe
596 svchost -> 135 TCP C:\WINDOWS\system32\svchost.exe
4 System -> 445 TCP
632 svchost -> 1025 TCP C:\WINDOWS\System32\svchost.exe
4 System -> 1026 TCP
632 svchost -> 3002 TCP C:\WINDOWS\System32\svchost.exe
632 svchost -> 3003 TCP C:\WINDOWS\System32\svchost.exe
2036 winFAH -> 3167 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 3332 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 3443 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 3602 TCP C:\Program Files\Accessories\winFAH.exe
3192 TaskPanl -> 3648 TCP C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
2036 winFAH -> 3659 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 3808 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 4378 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 4454 TCP C:\Program Files\Accessories\winFAH.exe
632 svchost -> 4707 TCP C:\WINDOWS\System32\svchost.exe
632 svchost -> 4714 TCP C:\WINDOWS\System32\svchost.exe
2036 winFAH -> 4734 TCP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 4908 TCP C:\Program Files\Accessories\winFAH.exe
796 -> 5000 TCP
3192 TaskPanl -> 8097 TCP C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
1128 tcpsvcs -> 7 UDP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 9 UDP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 13 UDP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 17 UDP C:\WINDOWS\System32\tcpsvcs.exe
1128 tcpsvcs -> 19 UDP C:\WINDOWS\System32\tcpsvcs.exe
2036 winFAH -> 123 UDP C:\Program Files\Accessories\winFAH.exe
596 svchost -> 445 UDP C:\WINDOWS\system32\svchost.exe
4 System -> 500 UDP
3192 TaskPanl -> 1900 UDP C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
2036 winFAH -> 1900 UDP C:\Program Files\Accessories\winFAH.exe
632 svchost -> 3011 UDP C:\WINDOWS\System32\svchost.exe
4 System -> 3039 UDP
2036 winFAH -> 3040 UDP C:\Program Files\Accessories\winFAH.exe
2036 winFAH -> 4300 UDP C:\Program Files\Accessories\winFAH.exe
this is one of the alerts I get from ZA:
a73bc66a95cf4f7b597fc8975778a889
The MD5 hash, or number, that
uniquely identifies the
executable.
Date Modified
May-11-2003 08:12:10 PM The date
when explorer.exe was most
recently modified.
Connect Type
Access This value can be either
Access, which is an Internet
connection attempt by Windows
Explorer or Server, which
indicates that Windows Explorer
is waiting for connections coming
in from the Internet.
Remote
Port 1900 The port Windows
Explorer is using on the remote
computer. |
|
