Tool Check - Windows98

Before I begin, please note that the scope of the request is limited to Windows98 only. :)

Anyway,

I have a very nice set of tools that I use to identify known/unknown malware/bots/spyware/etc.., however, the one thing I lack is a *very* good tool for process exploring on a Win98 host.

For instance, TCPView on 98 shows you all of the connections but unlike the Win32 version, it will not show you the path to the EXE associated with the process. While this certainly isn't a deal breaker for sr. engineers, many of my juniors sit at the host puzzled on where to go next when they encounter this. My goal is to get a Win98 process explorer that behaves exactly like TCPView does in a Win32 environment. That is, a tool that will provide a path to the EXE associated with a running process.

Do any of you have experience with a particular tool that meets this criteria? I'm certainly open to try anything that will allow me to produce an all-in-one USB toolkit for my junior staff.

Thanks in advance as always.

--TH13

Hmmmm,

Not too sure Hoss, but WinPatrol provides quite a bit of information, also there are some tools here:

http://www.karenware.com/powertools/powertools.asp

I am afraid I am not running a Win98 box at the moment, I will try and fire one up over the week-end and get back to you.



:)

Have not tried this myself, but maybe worth a look,
here you go: http://www.teamcti.com/pview/

This works great in XP, says it works in 9X also :

http://www.sysinternals.com/Utilitie...sExplorer.html

Shows paths and registry keys as well.

[quoteHave not tried this myself, but maybe worth a look,
here you go: http://www.teamcti.com/pview/[/quote]

Thanks Jinxy. This is pretty close. It lacks the connection table information which if it had, would be perfect.

Quote:

---

This works great in XP, says it works in 9X also :

http://www.sysinternals.com/Utiliti...ssExplorer.html

Shows paths and registry keys as well.

---

Yea, I'm VERY familiar with this tool. It doesn't do what I need it to though.

Thanks.

this looks like what your asking for

im not sure i understand what you mean by "connection table info"...ports to app to location? like fport?(which i know is not for 9x)

they say it works under XP-9x but i dont have any 9x boxen at the moment. here's the download page with a screen shot:

http://www.pcworld.com/downloads/fil...id,6102,00.asp


fport and similar tool rely on rpc/dcom to gather information. maybe if you upgraded the dcom component tools like fport might work:

http://www.microsoft.com/downloads/d...DisplayLang=en

just a guess and not knowing how many machines your talking about

I have roughly 2,000 Win98 hosts scattered over 350 locations. At any moment, one could become infected with a bot. When using TCPView on a Win32 system, I see the local IP address and port, remote IP address and port and I also have the ability to look at the full path to the EXE of the process that is responsible for the connection. Basically, I want a tool for Win98 that behaves precisely the way the TCPView does on Win32.

Make sense?

Thanks for the feedback.

--TH13

I really hope I don't have to write my own.

Hi Hoss:

http://www.sysinternals.com/Utilities/TcpView.html

If you look down the bottom you will see that they claim that the "Pro" version of TCPView does what you are saying for Win 9x

No idea if it works, or how much it costs, but it might be worth a look.

:)

Yeah, it certainly does what I need but they want $1,200 US plus $250 a year maintenance. I was hoping for something free, especially since Win98 will be gone from my environment in 18 months.

thanks for your efforts.

--TH13

http://lists.gpick.com/pages/Port_Tools.htm

This site has quite a few tools that might do the job. The stuff from DiamondCS, for example?

I can see your problem, you have one hell a lot of Win98 boxes in a networked environment. Mostly I have only encountered a few laptops (the power management thing).

The downside seems to be that there is not a lot of network tools that run on Win98, and those that there are, are only free to private users :(

How many junior staff do you have? I seem to recall that DiamondCS do "roving licences" maybe that would be an affordable option if it does the job?

:)

Thanks for the link Nihil. By sifting through the links, I found my way to DiamondCS Port Explorer. It does everything I need and then some for the awesome price of $40 for the enterprise license. You can't beat that!!


http://www.diamondcs.com.au/portexplorer/

Tested and it works!

--TH13

I don't know whether you had a look at there developers link, when you found port explorer.

Here: http://www.diamondcs.com.au/index.php?page=developers

You may be interested in some of this

Quote:

---

Free DiamondCS Source Code
An ongoing part of anti-trojan research is the development of source code to challenge, test, prove and disprove theories. Occassionally we can release such source to the public - this collection is now presented here and made available to all programmers and security researchers.

---