TechDen

Powerful Free Programs #5

spawn316 — Sun, 30 Mar 2008 13:58:00 +0000

HijackThis

A general homepage hijackers detector and remover. Initially based on the article Hijacked!, but expanded with a lot of other checks against hijacker tricks. It is continually updated to detect and remove new hijacks. It does not target specific programs/URLs, just the methods used by hijackers to force you onto their sites.

As a result, false positives are imminent, and unless you are sure what you’re doing, you should always consult with knowledgable folks before deleting anything.

DOWNLOAD

Myths About Computer Viruses

spawn316 — Sat, 29 Mar 2008 07:08:00 +0000

My Computer Stopped — I Must Have a Virus
If your computer stops, it could be because of a virus, but I doubt it. Bottom line: It’s in a virus’s best interest to let the computer continue to operate so the virus can continue to use the computer to spread itself to other computers. The “best” biological viruses in nature (what a concept) are like this, too. If they kill their host too quickly, there goes their opportunity to spread. A “better” biological virus — like a computer virus — will perhaps just make its host sick, but still well enough to keep spreading the virus.

That said, a virus writer could construct a virus that caused severe data damage only after it had been on the computer for an extended period of time. However, there is the risk (to the virus writer) that the virus might be detected and eliminated by antivirus software prior to the time it is programmed to inflict damage. If my computer stopped, I’d suspect hardware or Windows, in that order. I keep my antivirus program, firewalls (hardware and software), and antispyware software in good working order, so I’d suspect a virus last of all.

I Have Antivirus Software, So My Computer Can’t Get a Virus
Wrong answer. Even with antivirus software, several different factors can still mean that a virus can get in and/or hide in your computer:

_ If you fail to keep your antivirus signatures up to date, then any new virus may be able to get inside your computer.
_ If the “real-time” antivirus mechanism in your antivirus software is turned off or deactivated (this can and does happen in the real world from time to time), then the virus can walk right into your computer while the antivirus program is sleeping.
_ A brand-new virus can get into your computer even if you keep your antivirus signatures up to date. Remember, it can take a few days or longer for the antivirus software companies to detect, capture, and dissect new viruses before they can update their signature files. Even then, your computer will be protected only after it downloads the new signature file from the antivirus software company.
_ If you’ve been running your computer prior to getting antivirus software and you’ve put any files on it from any outside source — even if you’ve never connected to the Internet — there could already be a virus on your computer. If you don’t follow the installation procedures and skip the all-computer scan that most antivirus programs want to do when they’re first installed, it’s possible that a virus that you caught earlier is still be lurking in there.

All Viruses Are Destructive
I disagree with all statements that say all. (Well, most of them anyway.) Okay, word games aside, some viruses exist only to replicate themselves, and other than that, they do nothing harmful. But a purist would say that even these are harmful, because they upset their computers’ feng shui. A system with even a benign virus is tainted, and there could someday be some unintended consequence of that. Bottom line: This one’s arguable either way. Wanna have some fun? Get a couple of cyber-philosophers in a room and watch them argue this one for a couple of hours.

Viruses Can Damage Computer Hardware
I know I’m going to get into trouble with this one. Some expert out there is going to have a good counter-argument, but for the most part, this fear is false. Here’s how it looks from the virus writer’s perspective: Why aim for the hardware when there’s so much brittle software that can be damaged? Go for the easy target first. Besides, if the virus hurts the hardware, how’s it going to spread itself any further? The purist would argue that a virus can damage computer hardware by giving it instructions that make the system misuse some part of itself (for example, by writing excessively to the hard drive), but few such hardware-eating viruses have been released. This is partly because there are so many different types, makers, and formats of computer hardware that one virus would be hard put to trash all of them. Besides, nearly all computer hardware has built-in safeguards that prevent any real damage. But if you do get a virus and see sparks or flames shooting out of your computer or keyboard, please catch it on video and send it to me.

Viruses Can Hide inside Data Files
Hmmmm, well, this is theoretically possible, but I have not heard of such a virus. Yet. For now, viruses hide inside computer programs — and in the places where programs normally hang out (such as the boot sector of a floppy disk or a hard drive). By definition, data files aren’t executable, and viruses have to be executed. It’s safest to say that viruses hide only in executable program files. But wait. . . . Macro viruses are found in Word and Excel documents, so if this is what you mean by data files, then you’re correct. Other than this, generally viruses do not live inside data files.

Pictures Can Give You Computer Viruses
Nope. Well, not yet. Pictures are just data files that are read by special programs. But, someday, someone may come up with a picture file format that accommodates the inclusion of computer instructions — for whatever purpose someone dreams up. Are you thinking “macro virus” right now? So am I. Anytime someone comes up with a way to store data that includes a place for simple computer instructions (like Microsoft Word and Excel do), then the risk of malicious instructions becomes a real risk.

I Need More Than One Antivirus Software Program to Be Fully Protected
No, and no. Here’s what I mean. As long as you stick with one of well-known brands of antivirus programs, you’ll find that they all develop new virus signatures at about the same time. So if you’re thinking of switching from to because you think that gets their virus definitions out sooner, I personally wouldn’t waste my time.

You Can’t Get a Virus from an Official Software CD
I wish. It’s rare, but it has happened, and it very well could happen again. The big software companies have very good and almost byte-tight procedures that eliminate the possibility that a virus can sneak into a software development lab and from there to a CD master. It can happen. I wouldn’t laugh at you if you scanned CDs for viruses before installing software from them. Promise.

Antivirus Software Companies Create Viruses
To put it kindly, I don’t think so. Do the math: The antivirus companies have enough business trying to keep up with viruses “in the wild” that they’d be idiots to risk causing trouble for themselves. This sounds as crazy as Microsoft and Intel being in cahoots to keep us buying newer computers! Makes an entertaining (if trite) premise for a movie, maybe; doesn’t hold up so well in reality.

Some Countries Sponsor Virus Writers and Hackers
Gotcha. This one’s actually true. Three or four countries do have state-sponsored hackers. I shouldn’t name these countries by name, but many of them are known to be hostile to the United States in other ways. Some of these same countries sponsor hackers in order to give us a little trouble. Official attempts to disrupt and break into foreign information technology go back at least as far as the British code breakers who figured out the Nazi “Enigma” encryption machine in World War II. The adversaries have changed over the years, but their struggle has kept pace with the development of cyberspace, and it continues today.

Does My Computer Have a Virus?

spawn316 — Sat, 29 Mar 2008 06:27:00 +0000

Does your computer have a virus? Or are you just afraid that your computer has a virus? Either way, you’ve come to the right place. If your computer has started to act funny — if it just doesn’t feel right — then it’s possible (but not certain) that your computer has a virus. I’ll give you the information necessary to help you determine whether your computer has a virus, and then points you in the right direction to find out what to do next. Just remember this: Nobody deserves to get a computer virus. If you do have a virus, batten down the hatches and brace for a fight — viruses are a pain in the neck at best, and they can be much worse.

Looking at Common Virus Symptoms
Stalking the wild computer virus starts with observation: There are a lot of ways that a computer can begin to act strangely for no apparent reason. These changes in behavior may be the result of a virus, but there are other possible explanations as well. The following are some typical virus-induced symptoms, as well as some ways to determine whether a virus is responsible for your computer’s symptoms.

Computer too slow
The first thing to check when your computer is slow is to make sure that your computer isn’t in a school zone. Seriously, a slowing in your computer can be the result of a number of circumstances — and a virus is definitely among them. The following list provides some considerations for making an educated guess as to why your computer is slowing down:

Have you made any changes to your computer lately? For instance, have you upgraded to Windows 2000 or Windows XP? These newer operating systems require a lot more memory than their predecessors.

Have you upgraded a program? Like Windows 2000 and Windows XP, newer versions of many other programs like Microsoft Office and Microsoft Works require a lot more memory than earlier versions.

Have you or a loved one downloaded a lot of “nature”pictures or other information? Pictures and music take up space. If your hard drive is almost full, your computer will definitely run slower. If you’re sure you haven’t made any changes, then you may have a virus. You’ll have to check your computer’s behavior and run a number of simple tests before you can be sure.

Unexplained activity
Does your hard-drive or network-activity light flicker for no apparent reason? While there may be a legitimate reason for it, this could also be a sign that a virus or a hacker’s back-door program (a devious little program that allows secret access without your permission) is running on your computer. You might be donating some of your computer resources to a hacker and be largely unaware of it. Here are some examples of what could be going on if a hacker has gotten control of your computer:

_ The hacker could be using your computer to send thousands, even millions, of those annoying spam messages to people all over the Internet.
_ The hacker could be using your computer to launch attacks on corporate computing networks. In a DDoS (distributed denial of service) attack, for example, a hacker instructs thousands of “zombie” computers (like yours, perhaps) to send lots of messages to a particular corporate Web site, glutting its communications and knocking it off the Internet.
_ The hacker could be using your computer to scan other networks, hunting for vulnerable ports (communication channels for particular computer processes) that can mean more potential-victim computers.
_ The hacker may have installed spyware that reports back to the bad guys without the victim’s (your) knowledge.
One example is a key logger — a small program that records every key press and mouse movement in an attempt to learn your bank-account numbers, credit-card numbers, and other sensitive information that you probably don’t want strangers to know about.

Crashes or hangs
Does your computer crash often? Does it just stop responding? Do you often get the Blue Screen of Death? Again, there are many possible explanations. Crashing, hanging, and blue screens may be virus-induced, but they’re probably not. These maladies are more likely the result of new software, new drivers, or even a hardware component that’s beginning to fail. Check out those possibilities first.

Will not boot
Boot used to be a noun — the leather thing you put on your foot to protect it from rough terrain. These days boot is a verb just as often; it’s the process that your computer performs to start itself when you turn it on or press Ctrl+Alt+Del (the
“three-finger salute”). You guessed it — just because your computer won’t boot, it doesn’t necessarily mean that your computer has a virus. Maybe yes, maybe no. There are several other likely explanations — for example, a corrupted master boot record (the part of the hard drive that your computer uses to start up), or damage to an important file that your computer uses to start up.If either of these was the case, you’d probably have to rebuild your computer’s operating system and file system from scratch — not fun, even for the experts — and recovering any lost data could get dicey in a hurry. But you know, if you’re running Windows and have to reinstall your computer’s operating system, here are a couple of basic improvements to consider:

_ What better time to upgrade to Windows 2000 or Windows XP (unless you’re already running one of those)?
_ What better excuse to curl up with a good book — say, whichever Windows For Dummies book covers your newly installed version? This could be the perfect opportunity to read up on Windows while you’re waiting for the install to finish.

Strange computer behavior
Okay, computers sometimes behave inscrutably, but their behavior should be predictable. Same deal for viruses — which means they can’t completely conceal their activities. You can look for the devil in the details. Perhaps the signs are obvious (the colors go all weird, the computer puts words on-screen by itself, or it makes strange noises) or relatively subtle (your screen borders pinch inward for an instant just before you send e-mail). Time to observe closely and take notes. For openers, consider some “obvious” symptoms:

_ Files are not where you left them, and can’t be found on your computer. If your computer has become a Bermuda
Triangle that is eating your files, even some of your software, you might have a virus.
_ You can find the file, but its size or date stamp is suspiciously different. Viruses that infect program files may make the files bigger or smaller than they should be, or change their date stamps. Date stamps don’t ordinarily change on program files — ever — unless an official software patch changes them.
_ On-screen text starts to change by itself. In the old days of the DOS command prompt, one virus made the letters in on-screen text seem to move around “by themselves.” Sometimes they changed colors, or started consuming each other like Pac-Man. Bad sign. But you knew that.
_ An out-of-context message appears on-screen. Some viruses announce their presence by taunting the user. If you are greeted with a message such as Your computer is now Stoned!, you probably have a virus. Consider whether the message is out of context — for example, does it look like someone’s trying to cap a practical joke with a punch line? Not funny at all.

Too many pop-up windows
While I can’t prove it, I’d suspect that in some cases, Web sites that flood you with pop-up windows could also be attempting to download some malicious program(s) into your computer. Web sites that pump pop-ups into people’s computers are notorious for attempting to change the configuration of your Web browser and other parts of your computer — by remote control, without your knowledge or permission.

How Spyware Gets In

spawn316 — Sat, 29 Mar 2008 05:27:00 +0000

Spyware infiltrates a user’s computer via a number of methods. The most obvious sources are the other scum that are designed to wreak binary havoc: Some viruses, worms, and Trojan horses are designed to install spyware on victim computers either by carrying the spyware directly as a part of its payload or by downloading it after the virus has successfully implanted itself. Other sources aren’t so obvious to the untrained or unsuspecting user. The following sections explain what these common methods are and how they work so that you understand how your network and users are vulnerable.

Finding holes in the Web browser
The spyware taking up residence in a computer may be an ActiveX control, a browser snap-in (intended to extend browser functions), a browser helper object, or a standalone executable that is loaded into the user’s computer when he or she visits a Web site that contains the spyware. The spyware may load because of a security setting that is too lax, such as permitting the downloading of unsigned ActiveX controls. Spyware can also install itself via one of many vulnerabilities that have been discovered in recent years. For instance, it could be an ActiveX control that is specially designed to fool the browser into thinking that the control is coming from a Trusted Sites Zone or Intranet Zone instead of the Internet Zone.

Tagging along in e-mail
E-mail programs that display HTML e-mail (such as Outlook, Outlook Express, and Mozilla Thunderbird) are often subject to the same vulnerabilities that have beset Microsoft Internet Explorer in recent years. Often, just displaying a mail message is sufficient for the spyware to get loaded in the user’s computer. This is because Outlook is using the same vulnerable DLLs to display HTML as is used by Internet Explorer.

Hiding in software downloads
Many downloadable software programs — and programs that you can purchase online or over the counter — contain spyware programs that are silently installed when you install the software. Sometimes (but not always), the software’s
End User License Agreement (EULA) states that “other programs may be installed.” How many people read the fine print? I must admit that I don’t always read the EULA before installing software. Maybe you should add “carefully read all license agreements” to your list of New Year’s resolutions, no matter what time of year it is now.

Peer-to-peer file sharing
Although nothing is inherently wrong with peer-to-peer file sharing, almost all its actual uses are illegal, and as the saying goes, “If you play with fire, you will get burned.” The predominant use of peer-to-peer file sharing is to share music files and other protected or copyrighted content, typically illegally, with others on the peer-to-peer network. Legal problems aside, the software for these peer-to-peer networks leaves a computer or network open to spyware in the following ways:

- The software doesn’t limit the files that might be shared to just music, so frequently what comes down the peer-to-peer pipe is spyware.

-Some peer-to-peer programs themselves have spyware bundled with them that gets installed when the peer-to-peer program is installed. The result is a pretty ugly situation. Not only does the peer-to-peer software poke several holes in your system, enabling spyware to seep in, but some software also contains vulnerabilities that allow people to retrieve any file they choose to from the peer computer. Is it any wonder, then, that many companies forbid the use of peer-to-peer sharing programs?

How Spyware Gets Information from Your Computer

spawn316 — Sat, 29 Mar 2008 04:57:00 +0000

Spyware creators have an arsenal of tricks for extracting information from a user’s computer. Most utilize a Web browser as a coconspirator, but spyware can also sneak in when other programs are installed, as well as if a virus or worm successfully lodges itself in a user’s computer.

Hijacking cookies
A Web site can attempt to access a cookie that is associated with another Web site (in case you’re not familiar with how cookies work, one Web site is not supposed to be able to access any cookies except for those it left there earlier). For example, if you’re visiting www.scumads.com (not a real site), that site may try to retrieve your Yahoo! or Google cookie by impersonating the original Yahoo! or Google site in particular ways.

Executing programs
Running a program on your computer might be what’s needed to install certain spyware, but running a program could also be what the spyware does after it’s installed. A vulnerability in Internet Explorer can permit a Web site to download and execute a malicious ActiveX control that, in turn, can do pretty much anything it wants on a user’s computer, including run other programs or download additional programs and files to the user’s computer.

Reading the Clipboard
Another one of those supposedly friendly features of Internet Explorer is its ability for Web sites to read the contents of your Clipboard. Although I can imagine the potential usefulness of sharing the Clipboard, in my mind this also spells trouble. Who knows what could be on your Clipboard at any given time? Do you ever copy pathnames, URLs, user IDs, passwords, or paragraphs of confidential information? I can smell the potential danger, and I hope you do, too.

Accessing the hard drive
An ActiveX control on a Web page can not only access the user’s hard drive, but also read and write data on that hard drive. Combined with other vulnerabilities, scripting on a Web page can cause any data on a user’s hard drive to be moved, altered, destroyed, or copied over the Internet to any location.

Spoofing well-known Web pages
A cleverly (or, I should say, diabolically) coded Web page can impersonate a well-known Web page, including the URL in the browser’s address bar! The vulnerabilities that permit this gave rise to many successful phishing scams. (A phishing scam is typified by official-looking e-mail messages that lure unsuspecting victims to Web sites where they are asked to surrender sensitive information, such as financial institution user IDs and passwords, or perhaps credit card or bank account numbers.)

Tracing A Hacker

spawn316 — Thu, 27 Mar 2008 15:55:00 +0000

Sometimes, it’s just not enough to simply know that there’s a Trojan or Virus onboard. Sometimes you need to know exactly why that file is onboard, how it got there – but most importantly, who put it there. By enumerating the attacker in the same way that they have enumerated the victim, you will be able to see the bigger picture and establish what you’re up against. But how can you do this?

Read on…

Connections Make the World Go Round
The computer world, at any rate. Every single time you open up a website, send an email or upload your web pages into cyberspace, you are connecting to another machine in order to get the job done. This, of course, presents a major problem, because this simple act is what allows malicious users to target a machine in the first place.

How do these people find their victim?
Well, first of all, they need to get hold of the victim’s IP Address. Your IP (Internet Protocol) address reveals your point of entry to the Internet and can be used in many ways to cause your online activities many, many problems. It may not reveal you by name, but it may be uniquely identifiable and it represents your digital ID while you are online (especially so if you’re on a fixed IP / DSL etc).

With an IP address, a Hacker can find out all sorts of weird and wonderful things about their victim (as well as causing all kinds of other trouble, the biggest two being Portnukes/Trojans and the dreaded DoS ((Denial of Service)) attack). Some Hackers like to collect IP Addresses like badges, and like to go back to old targets, messing them around every so often. An IP address is incredibly easy to obtain – until recently, many real time chat applications (such as MSN) were goldmines of information. Your IP Address is contained as part of the Header Code on all emails that you send and WebPages that you visit can store all kinds of information about you. A common trick is for the Hacker to go into a Chat room, paste his supposed website address all over the place, and when the unsuspecting victim visits, everything about your computer from the operating system to the screen resolution can be logged…and, of course, the all important IP address. In addition, a simple network-wide port scan will reveal vulnerable target machines, and a war-dialler will scan thousands of lines for exposed modems that the hacker can exploit.

So now that you know some of the basic dangers, you’re probably wondering how these people connect to a victim’s machine?

Virtual and Physical Ports

spawn316 — Thu, 27 Mar 2008 15:53:00 +0000

Everything that you receive over the Internet comes as a result of other machines connecting to your computer’s ports. You have two types; Physical are the holes in the back of your machine, but the important ones are Virtual. These allow transfer of data between your computer and the outside world, some with allocated functions, some without, but knowing how these work is the first step to discovering who is attacking you; you simply MUST have a basic knowledge of this, or you won’t get much further.

What the phrases TCP/UDP actually means
TCP/IP stands for Transmission Control Protocol and Internet Protocol, a TCP/IP packet is a block of data which is compressed, then a header is put on it and it is sent to another computer (UDP stands for User Datagram Protocol). This is how ALL internet transfers occur, by sending packets. The header in a packet contains the IP address of the one who originally sent you it. Now, your computer comes with an excellent (and free) tool that allows you to see anything that is connected (or is attempting to connect) to you, although bear in mind that it offers no blocking protection; it simply tells you what is going on, and that tool is NETSTAT.

Netstat: Your First Line of Defense

spawn316 — Thu, 27 Mar 2008 15:47:00 +0000

Netstat is a very fast and reliable method of seeing exactly who or what is connected (or connecting) to your computer. Open up DOS (Start/Programs/MS-DOS Prompt on most systems), and in the MSDOS Prompt, type:

netstat -a

(make sure you include the space in between the “t” and the “a”).
If you’re connected to the Internet when you do this, you should see something like:

Active Connections
Proto Local Address Foreign Address State
TCP macintosh: 20034 modem-123.tun.dialup.co.uk: 50505 ESTABLISHED
TCP macintosh: 80 proxy.webcache.eng.sq: 30101 TIME_WAIT
TCP macintosh MACINTOSH: 0 LISTENING
TCP macintosh MACINTOSH: 0 LISTENING
TCP macintosh MACINTOSH: 0 LISTENING

Now, “Proto(col)” simply means what kind of data transmission is taking place (TCP or UDP), “Local address” is your computer (and the number next to it tells you what port you’re connected on), “Foreign Address” is the machine that is connected to you (and what port they’re using), and finally “State” is simply whether or not a connection is actually established, or whether the machine in question is waiting for a transmission, or timing out etc. Now, you need to know all of Netstat’s various commands, so type:

netstat ?

You will get something like this:

Displays protocol statistics and current TCP/IP network connections.

NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval]
-a Displays all connections and listening ports.
-e Displays Ethernet statistics. This may be combined with the -s option.
-n Displays addresses and port numbers in numerical form.
-p proto Shows connections for the protocol specified by proto; proto may be TCP or UDP. If
used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are shown for TCP, UDP and IP; the -p
option may be used to specify a subset of the default.

Have a play around with the various options, but the most important use of these methods is when you combine them. The best command to use is

netstat -an

because this will list all connections in Numerical Form, which makes it a lot easier to trace malicious users….Hostnames can be a little confusing if you don’t know what you’re doing (although they’re easily understandable, as we shall see later). Also, by doing this, you can also find out what your own IP address is, which is always useful. Also,

netstat -b

will tell you what ports are open and what programs are connecting to the internet.

Types of Ports

spawn316 — Thu, 27 Mar 2008 15:42:00 +0000

It would be impossible to find out who was attacking you if computers could just access any old port to perform an important function; how could you tell a mail transfer from a Trojan Attack? Well, good news, because your regular, normal connections are assigned to low, commonly used ports, and in general, the higher the number used, the more you should be suspicious. Here are the three main types of port:

Well Known Ports
These run from 0 to 1023, and are bound to the common services that run on them (for example, mail runs on channel 25 tcp/udp, which is smtp (Simple Mail Transfer Protocol) so if you find one of these ports open (and you usually will), it’s usually because of an essential function.

Registered Ports
These run on 1024 to 49151. Although not bound to a particular service, these are normally used by networking utilities like FTP software, Email client and so on, and they do this by opening on a random port within this range before communicating with the remote server, so don’t panic (just be wary, perhaps) if you see any of these open, because they usually close automatically when the system that’s running on them terminates (for example, type in a common website name in your browser with netstat open, and watch as it opens up a port at random to act as a buffer for the remote servers). Services like MSN Messenger and ICQ usually run on these Ports.

Dynamic/Private Ports Ranging from 49152 to 65535
These things are rarely used except with certain programs, and even then not very often. This is indeed the usual range of the Trojan, so if you find any of these open, be very suspicious. So, just to recap:

Well Known Ports 0 to 1023 Commonly used, little danger.
Registered Ports 1024 to 49151 Not as common, just be careful.
Dynamic/Private Ports 49152 to 65535 Be extremely suspicious.

The Hunt Is On

spawn316 — Thu, 27 Mar 2008 15:38:00 +0000

Now, it is essential that you know what you’re looking for, and the most common way someone will attack your machine is with a Trojan. This is a program that is sent to you in an email, or attempts to bind itself to one of your ports, and when activated, it can give the user your passwords, access to your hard drive…they can even make your CD Tray pop open and shut. At the end of this Document, you will find a list of the most commonly used Trojans and the ports they operate on. For now, let’s take another look at that first example of Netstat….

Active Connections

Proto Local Address Foreign Address State
TCP macintosh: 27374 modem-123.tun.dialup.co.uk: 50505 ESTABLISHED
TCP macintosh: 80 proxy.webcache.eng.sq: 30101 TIME_WAIT
TCP macintosh MACINTOSH: 0 LISTENING
TCP macintosh MACINTOSH: 0 LISTENING
TCP macintosh MACINTOSH: 0 LISTENING

Now, straight away, this should make more sense to you. Your computer is connected on two ports, 80 and 27374. Port 80 is used for http/www transmissions (i.e. for all intents and purposes, it’s how you connect to the net, although of course it’s a lot more complicated than that). Port 27374, however, is distinctly suspicious; first of all, it is in the registered port range, and although other services (like MSN) use these, let’s assume that you have nothing at all running like instant messengers, WebPages etc….you’re simply connected to the net through proxy. So, now this connection is looking even more troublesome, and when you realize that 27374 is a common port for Netbus (a potentially destructive Trojan), you can see that something is untoward here. So, what you would do is:

run Netstat , and use:
Netstat -a
then
Netstat -an
So you have both Hostnames AND IP addresses.