How To Monitor Users Connected to my PC

hjm357 · Post by **hjm357** » Tue May 11, 2004 1:10 am

What is the best program to montior what users are connected to my computer?

I am interested in this for this reason. I have been running norton systemworks, and have the "users connected" monitor on. Occationally there will be a user connected (i've seen up to 3) and honestly i do not what this means. Would certain programs normally be connecting and registering as a user? I am behind a router with 2 other PCs on the network, although i do not have file sharing enabled. I am curious what to make of this.

Thanks for any help

TonyT · Post by **TonyT** » Tue May 11, 2004 7:04 am

Connected users =
1. other users on the network
2. file sharing programs (winmx, kazaa, etc
3. messanger apps like aim, yahoo im, etc
4. trojans, backdoor viruses
5. remote access apps like pc anywhere etc

hjm357 · Post by **hjm357** » Tue May 11, 2004 9:58 am

is there a program that can monitor this and tell me who is connected?

TonyT · Post by **TonyT** » Tue May 11, 2004 9:18 pm

TCP View (all free utilities)
http://www.sysinternals.com/ntw2k/utilities.shtml

hjm357 · Post by **hjm357** » Tue May 11, 2004 10:50 pm

in that program, what do the processes called [System Process]:0 represent? I cannot access the properties of these. I ask because there are several of those whose remote address is my mail server, and a couple of things have made me suspicious that i have a problem with a virus/spyware.

TonyT · Post by **TonyT** » Wed May 12, 2004 7:15 am

don't worry about svchost and system;4 processes.

dreadlocke · Post by **dreadlocke** » Mon May 17, 2004 6:11 am

TonyT, very good choice in tools, however anything sysinternals develops can instantly overwhelm even a network adept.

hjm, I'm going to assume you run WinXP. Please post if otherwise.

In order for another PC to connect to your PC, LSASS must authenticate the user via NTLM. The server service must also be running ... (since you dont want anyone connecting, disable it.) Check the Users and Groups mmc and verify that you don't have funky accounts.

Second, enable auditing. This is one of the simplest ways to discover any monkey business happening with accounts/services. And enable full auditing accross the board except process tracking.

Also, get yourself a good port monitor such as Port Explorer, which will display all TCP/IP sockets and remote connections.

Alas, just fire up a good 'ol command prompt and type netstat -a ... or use the free fport from foundstone. Quick and easy.

As far as I know (and couold be wrong) no one has a non-server tool that simply states (you have X people connected and this is who they are) Norton is most likely ennumerating something local, not remote users.

Lastly, only Windows Server products can maintain more than 1 concurrent remote access connection.

Good Luck,
DreadLocke