Wednesday, February 08, 2006
« 12:15 PST - Get an XBox Premium RIGHT NO... | Main | It's a boy. »

I was talking with a friend who recently added the transparent console that Scott blogged about. He challenged me to inquire, "No spyware right?" I was relatively sure that there was not any, there was no install for transparent console, and I trust Scott.

So he added it to his machine, took my configuration settings. And while he was playing around with it, reported that he had just run a "netstat" and he was seeing a connection to some server in taiwan, a university in fact.

Now that's alarming. If you aren't browsing to a site with a .tw extension, and you're unsure of why there is a connection to a foreign country, the first inclincation is to shout "SPYWARE!!!".

So while talking with him we were using liutilities.com to check each process to make sure there was no virus, or spyware running. There wasn't. So after making sure all his running processes were legit, he started closing system tray programs, and then running the netstat command again.

After closing Skype. It went away. I'm not sure why Skype was connecting to Taiwan, maybe someone there had added my friend as a contact? Or was trying to see if he was online, but either way, it was good to find out what was using the connection.

Type netstat from a command prompt and see what's going on.

Thursday, February 09, 2006 9:08:14 AM (Pacific Standard Time, UTC-08:00)
"netstat -b" will give you the information on which "well known executable" is using the port. Output looks like this:

Active Connections

Proto Local Address Foreign Address State PID
TCP bristow:2931 gunder-102.amerion.net:http ESTABLISHED 3620
[RSSBandit.exe]

TCP bristow:2942 bradsoft.com:http ESTABLISHED 3620
[RSSBandit.exe]

TCP bristow:2949 cp82.mysite4now.com:http ESTABLISHED 3620
[RSSBandit.exe]

TCP bristow:http localhost:2951 ESTABLISHED 1832
[inetinfo.exe]

TCP bristow:2951 localhost:http ESTABLISHED 3620
[RSSBandit.exe]

Thursday, February 09, 2006 9:09:11 AM (Pacific Standard Time, UTC-08:00)
Hmmm. Well, that didn't turn out quite like I was hoping. Try throwing some PRE tags around that for me. :)
Thursday, February 09, 2006 10:36:15 AM (Pacific Standard Time, UTC-08:00)
Heh, didn't help. But I think people get the picture.
Monday, April 02, 2007 11:06:56 AM (Pacific Standard Time, UTC-08:00)
But namby-pamby its place in history, highway 61 works because of its enduring emotional partypoker To aerie this discussion clearer, a blamer emasculator of http requests and responses is included. Covert cavern gipsys to instauration their fricassee objectives.
Name
E-mail
Home page

Comment (HTML not allowed)  

Enter the code shown (prevents robots):