computer scanning port 445

One of our computers keeps periodically scanning port 445 on the
internet. Thus far we have not been able to find the program source.
We have tried Norton Antivirus. McAffee. ZoneAlarm and still haven't
found the source, it just continues making random scans 192.168.*.*
about 1 per minute.

Any ideas on how to track this down on a W2K system?

phwashington@attbi.com wrote:
> One of our computers keeps periodically scanning port 445 on the
> internet. Thus far we have not been able to find the program source.
> We have tried Norton Antivirus. McAffee. ZoneAlarm and still haven't
> found the source, it just continues making random scans 192.168.*.*
> about 1 per minute.
> Any ideas on how to track this down on a W2K system?

netstat -ano

Or try http://www.sysinternals.com/Utilities/TdiMon.html

Yours,
VB.
--
Irony has to be marked as clear as possible. Please use asterisks
AND underlines AND <irony>-tags to make that clear - and don't forget,
that closing </irony>-tags are needed to compensate any sarcasm.

On 21 Jul 2005 11:56:44 -0700, phwashington@attbi.com wrote:

>One of our computers keeps periodically scanning port 445 on the
>internet. Thus far we have not been able to find the program source.
>We have tried Norton Antivirus. McAffee. ZoneAlarm and still haven't
>found the source, it just continues making random scans 192.168.*.*
>about 1 per minute.
>
>Any ideas on how to track this down on a W2K system?

Try Trojan Defense Suite, aka TDS-3 from http://tds.diamondcs.com.au/

This is not just a trojan scanner, it has many tools to help you
identify ports opened and processes.

phwashington@attbi.com wrote:
> One of our computers keeps periodically scanning port 445 on the
> internet. Thus far we have not been able to find the program source.
> We have tried Norton Antivirus. McAffee. ZoneAlarm and still haven't
> found the source, it just continues making random scans 192.168.*.*
> about 1 per minute.
>
> Any ideas on how to track this down on a W2K system?

Thanks for the help guys. I did track it down. It was sysmon32.exe.
I'll keep the info handy, I have a feeling I might need the information
again.

"speeder" <no.spam@invalid.com> wrote in message
news:rlt0e1tki7v61l56aetm0j7rch0ag0i5v0@4ax.com...
> On 21 Jul 2005 11:56:44 -0700, phwashington@attbi.com wrote:
>
> >One of our computers keeps periodically scanning port 445 on the
> >internet. Thus far we have not been able to find the program source.
> >We have tried Norton Antivirus. McAffee. ZoneAlarm and still haven't
> >found the source, it just continues making random scans 192.168.*.*
> >about 1 per minute.
> >
> >Any ideas on how to track this down on a W2K system?
>
> Try Trojan Defense Suite, aka TDS-3 from http://tds.diamondcs.com.au/
>
> This is not just a trojan scanner, it has many tools to help you
> identify ports opened and processes.

It's dead, Jim

speeder <no.spam@invalid.com> wrote:
> Try Trojan Defense Suite, aka TDS-3 from http://tds.diamondcs.com.au/
> This is not just a trojan scanner, it has many tools to help you
> identify ports opened and processes.

No-one needs such tools. You can't trust any tool, which is running
on a compromized system.

Yours,
VB.
--
Irony has to be marked as clear as possible. Please use asterisks
AND underlines AND <irony>-tags to make that clear - and don't forget,
that closing </irony>-tags are needed to compensate any sarcasm.

I recommend you use this software, it should be able to resolve your
problem!

It call "Secrutiy expert", This is its main page

recommend you use this software, it should be able to resolve your
problem!


It call "Security expert", This is its main page


http://securityexpert.cnns.net