&EEgr;&mgr;&egr;&rgr;&ogr;&mgr;&eegr;&ngr;&iacgr;&agr;: 26.04.02
&Agr;&pgr;&ogr;&sgr;&tgr;&ogr;&lgr;&eacgr;&agr;&sfgr;: Richard Gillespie, DC (aka "RGD")
&OHacgr;&rgr;&agr;: 08:29
RGD> I was told that a good indicator to watch for if you suspect a spy in your
RGD> computer is to watch the little Internet Phone Connection icon that resides
RGD> in your tray. If it flashes occassionally even though you are not receiving
RGD> or sending email, you might be infected. Any ideas on this, List?
Yes, of course.
Let's suppose that a guy named Pantelis is on-line and has just clicked on
the "Send Mail" button of his mail client.
Now, after a couple of minutes Pantelis notices a flash of the "little
Internet Phone Connection icon" while he doesn't use any Internet
services. That is: no web/IRC/usenet/telnet/IM etc. Furthermore, he
has terminated his mail client (thus preventing the program from
communicating with a remote POP server for incoming mail).
Should Pantelis panic?
I say "No."
Perhaps, he is "infected" but he can't be sure for now.
Instead of yelling, he could open a "Command Prompt window" and issue the
following command:
c:\> netstat
This command prints all the connections between Pantelis' PC and the rest
of the world. The last column of the output (IIRC) reports the status
of the connection (ESTABLISHED, SYN_SENT, etc).
"ESTABLISHED" means that the connection is "live" and that data is being
exchanged between Pantelis' PC and another computer. This can be a rather
strong sign that "something is going wrong".
In order to check out which program is responsible for this behaviour,
Pantelis could press "Ctrl+Alt+Del" and check out the running
applications.
If after that can't still figure out what's wrong, he could download a
program named "inzider" that lists the applications that "listen" to
internet ports.
Possibly, the "flashing" is due to port scans and/or ping requests.
HTH
--
[ Quote #285 from miscellaneous collection. ]
In case of fire, stand in the hall and shout "Fire!"
-- The Kidner Report
============= PCWorks Mailing List =================
Don't see your post? Check our posting guidelines &
make sure you've followed proper posting procedures,
http://pcworkers.com/rules.htm
Contact list owner <[EMAIL PROTECTED]>
Unsubscribing and other changes: http://pcworkers.com
=====================================================
