remote PC netstat -a

MuSsEr · 2 May 2007 at 16:02

Can anyone assist me, we have a PC at work which keeps being controlled by someone but it is not using either of the two programs we use for remote controlling PCs...VNC and Altiris

I would like to run something similar to the command that can be run from the command prompt "netstat -a" which gives you a list of all connections currently on the pc
But I am not sure how to run this remotely on another PC

Can anyone offer any advise on how to run this command, or if there is one more suitable, or if there is a program I can run on the PC to log connections to it

thanks in advance

MuSsEr · 4 May 2007 at 03:32

any help?

Subliminal Aura · 4 May 2007 at 03:48

why ?

Is the remote user authorised to use it ?

Why don't you shut off access to the machine through your company firewall ?

.walls · 4 May 2007 at 10:27

um... download pstools

psexec \\<remote_pc_name> cmd return
netstat -a return

or

psloggedon \\<remote_pc_name> return

MuSsEr · 4 May 2007 at 15:44

Subliminal Aura said:
why ?

Is the remote user authorised to use it ?

Why don't you shut off access to the machine through your company firewall ?

no one excpet domain admins should be able to access any machine on the network, it has now happened on a 2nd machine as well

I have an ip monitoring tool now which should hopefully tell me where its coming from

Uhtred · 4 May 2007 at 15:59

someone got a root kit on there somehow? Why are you allowing these pcs to be controlled, take them off the network and go through them with a fine tooth comb

MuSsEr · 4 May 2007 at 19:30

all 4000 in shops round the country? dont think thats gona happen, lol

Subliminal Aura · 4 May 2007 at 19:49

Zap said:
someone got a root kit on there somehow? Why are you allowing these pcs to be controlled, take them off the network and go through them with a fine tooth comb

Agreed the sys admin also needs a P45.

MuSsEr · 5 May 2007 at 09:18

the pcs are allowed to eb controlled because we use a piece of software called altiris to monitor and support them, not going to drive all the way to a shop in scotland just to set up a printer for a user when it cane be done from our desks

Uhtred · 5 May 2007 at 20:46

that's really not what i meant.

we have a PC at work which keeps being controlled by someone but it is not using either of the two programs we use for remote controlling PCs...VNC and Altiris

So there is something else on the machines that is allowing them to be controlled. The first thing you'd do is take that machine off the network

mark.souness · 6 May 2007 at 01:14

look on the task bar to see if someone has installed logmein client?

MuSsEr · 6 May 2007 at 08:50

unless it is something like a trojan allowing it to be controlled there is nothing on the machine as it happened to one of our domain admins pc's yesterday and it def shouldn't have anything on it