Sysinternals: Process Monitor - How to find the process from an IP add

[King of Ping]

Hello all,

I have a strange case and I would appreciate any pointers.

I'll outline the details that I have

I have alerts triggered from my firewall pointing to a pc inside my firewall.

The log gives me:

a source address, i.e. the ip address of a client on my LAN.

a destination address, traced to a website hosted in Istanbul.

time of the communication.

the port used.

From here I ran wireshark on the source computer to validate the info from my firewall.

i.e. the destination address from the firewall is appearing in the capture file from wireshark.

I also ran Sysinternal: Process monitor as there must be some malware process on the client triggering the communication.

I know the I can run a network capture within process monitor but I don't know how to find out what process is running to cause this?

Can anyone offer me any advise on how to do this using process monitor or an alternative utility please?

I'm really concerned about this as the user of the infected computer has had the bank account accessed since I have been getting these alerts.

I've completely rebuild the computer, fully patched it and it's up to date with McAfee virusscan but it's still creating alerts.

Kind regards,

K.o.P.

[bludgard]

Hi, K.o.P. Welcome to Windows Forum.

I am sure your firewall settings are set correctly; or check that some feature(s) or rules previously enabled may have been disabled. Possibly the other way around. Anyway, check the settings and even disable all exceptions. The path to these configurations may vary depending on the program used.

If you suspect virus/malware invasion, possibly try running different virus/malware scans. I know of two that I could recommend and are portable (no installation necessary).

http://www.superantispyware.com/portablescanner.html,

http://malwarebytes.gt500.org/

Well, it would seem that one of these programs needs to be installed, (MBAM). …I thought I used a potable version of Malwarebyte’s Antimalware, but I could be confused as well….

Knowing what processes are normally runny on a healthy machine (depending on software and/or operating system), and comparing this to what is actually running on the suspect machine, one may notice an outstanding process running when it may not have been there before. This is not true 100% of the time.

Is your LAN settings password protected? Is your network a secured connection (password protected)? At what level is the security set? Are you on a dedicated network, or is it shared?

Any information on the alleged ill machine may be helpful with future diagnostics.

Jody