How to ID

[socalgal]

Hi Guys/Gals

How can I identify the file which triggers an outgoing port request to a specific IP?

ZA picked up this IP and the Whois traced to some foreign mulitmedia consumer service. I want to know which file activated this process.

Thanks for any insights!

[jadison]

I'm not sure, but maybe there's a .dll file that activated the ping. Usually there's a hidden file in the Program that activates the request. Sorry if that didn't help,

is Whois a program- what does it do and where can I get it?

jadison

[shadow]

SmartWhois is a program that lets you plug in an ip# which will then trace it for you showing where it originates. When your firewall shows a hit, you can find out where it came from. Download it here: http://www.tamos.com/download.htm
Socalgal, you may want to point your newsreader to grc.com There's a good newsgroup there where the talk is about security and ZA.
I was thinking of Jammer, but don't know if it can identify the program sending out from your computer.
How do you like ZA? Have you seen that a new version with logging capabilities is out now? I am still using 2.026 (works great)and will wait to hear about bugs before I go to the newest one....I hate BSOD's, which I got alot of with the earlier version of ZA.
PW

[jadison]

If u don;t have a firewall (hence I have no network), does the program still work?

[shadow]

Yes WhoIs will work as long as you have an internet connection.
PW

[socalgal]

Hi, thanks for the replies. Shadow, you've probably seen the other ZA thread going on here.. http://www.sysopt.com/forum/smile.gif

I like ZA's features, but it's off my system until the dust settles. I already have BID, The Cleaner and Jammer - Jammer runs a netstat and notifies of attempted registry writes. But there's no pointer to the activator file that I can find...

Funny thing is, I got ZA just about a week or so ago.. I waited and kept reading reviews/posts to see how others reported how well it worked...

I'm running another program and need to research a little more before I can safely say that it's producing the name of the file I'm seeking.