ROOM 3 & 3R
BEGINNERS
PRESENTATION
9:30 AM

GENERAL
MEETING
10:30 AM

SPECIAL INTEREST GROUPS:
If you would like to meet in a small group to discuss one of the following subjects, contact the following people.

What Your Computer Really Does When It's Idle by Vinny La Bash, vlabash@home.com
Member of the Sarasota Personal Computer Users Group, Inc.

You're sitting at your machine, thinking about what to do next, when your disk drive starts whirring and the light flashes, indicating that something is going on. What is your machine doing? Your hands are nowhere near the keyboard or the mouse, and you can be relatively certain that neither telepathy nor telekinesis is at work.

 One possibility is that your system is loading automatic updates from Microsoft.com because you set your system to download updates automatically. The same could be true for anti-virus programs, firewalls or any application software that offers this type of automated service.

 The Task Scheduler may be running a background utility. Your automatic backup may be kicking in, or an online subscription service is delivering requested information as part of a service it provides. Any number of similar operations could be going on. There is a dark side to this. You may be infected by a spyware program reporting back to its master over the internet. Most spyware blabs about your web surfing habits to a commercial entity so that it can tailor ads to your individual tastes. Many people consider this annoying or intrusive. Nevertheless, the designers of these programs have no desire to hurt you. They want only to sell you something.

 However, something far less benign could be going on. A program could be attempting to steal your banking information, PIN numbers, credit card records, social security information, and other financial data with the intention of draining your bank account.

 A Trojan horse program may be downloading spam to retransmit from your machine, making it look to recipients that you are the spammer. Other programs make your machine a "zombie" or a node in an array of machines designed to launch a Denial of Service (DOS) attack on a web site.

 Worst of all, there have been instances reported of stealth programs downloading child pornography and retransmitting it to another machine. These programs make it look like you are the culprit, making you subject to arrest and incarceration. This kind of frighteningly malicious activity has been rare, but the danger is real.

 If you are concerned about this, and you should be, Windows XP offers a solution:

Click Start.

Click Run.

In the text portion of the Run dialog box, type cmd and click OK.

This brings you to the Command Interpreter, which starts out by displaying the Version of XP that's running on your machine and some copyright information. Now enter the command netstat -o, which displays network statistics about your current active connections.

There are five columns of information displayed. The Proto column tells you what communication protocol is being used for a particular process. In most instances this will be TCP (Tele-Communications Protocol). This is irrelevant for our purposes. Local Address is your machine.

Foreign Address is the IP address and port number of the machine the process is communicating with.

State informs you if the communication session is sending or receiving, waiting, acknowledging or finished.

PID (Process Identifier) is the piece we need, because it identifies the process (program) that is controlling the communications session from your computer.

4. Perform the Ctrl+Alt+Del keystroke sequence to bring up the Windows Security window.

5. Click Task Manager.

6. Click the Processes tab.

7. Click the PID column. This sorts the information, making it easier to find the program you're looking for.

Note: If the PID column is not displayed, you can activate it from the View menu.

Examine the PID list until you find the PID number(s) you found with the netstat command. If it's msnmgr.exe or iexplorer.exe, there is nothing to worry about. These are normal Windows XP processes and no cause for concern. There are many other legitimate Windows XP processes that are likely to be listed in the Task Manager.

How do you tell the good from the bad? Unfortunately, Windows itself isn't much help in showing what any given process is doing and you can't shoot them all and "let God sort them out". A search of Microsoft's web site won't yield useful information.

A great place to find valuable information about common Windows processes is:

http://www.liutilities.com/products/wintaskspro/processlibrary/

This site contains information about all common Windows processes, and the site administrators do an excellent job of keeping posted information current.

Knowing what's going on in your system is good, but the best protection against intruders is to keep your anti-virus, firewall, and other specialized protection programs up-to-date. :

There is no restriction against any non-profit group using this article as long as it is kept in context with proper credit given the author.  The Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member, brings this article to you.