Introduction

ProPort v2.2
by: the Digital Underground
quid erat demonstrandum

Help File Contents:

  • Toolbar Command Buttons
  • Traffic Monitor
  • Process Manager
  • Start-Up File Edittor
  • Directory Scanning
  • Changing ProPort's Settings
  • Remote Filtering
  • Attack Log


Toolbar Buttons

Using the Toolbar Buttons

Refresh

This option will refresh the traffic monitor. If the monitor is disabled, this will manually re-list the connections on the local computer.

Enabled/Disabled

This toggle button enables and disables the traffic monitor. The monitor is refreshed every 1 second (default), disabling it will not allow the monitor refresh, and enabling it will.

Resolve

This option makes ProPort automatically resolve the IPs to their hostnames. Using this may cause ProPort to briefly stop responding, depending on the amount of connections it finds. Using this option is helpful for determining where every connection is from.

Filter On/Off

This toggle button turns the remote filter on and off. Depending on your preference, you may want to use the remote filter to exclude things like WWW traffic from monitoring.

A-S Spy (AutoStart Spy)

This toggle button enables and disables the AutoStart Spy. This spy detects changes that occur to common start-up methods used by trojans. Startup methods are how Trojans are loaded every time the infected computer is started. When a change is detected, ProPort will prompt the user asking if the change is allowed.

Example:

Start Up

This option makes ProPort automatically load every time Windows is started. With the option selected, after starting Windows ProPort will appear in the system tray next to the clock.

About

Pretty self-explanatory, just shows the about page of ProPort.


Traffic Monitor

Using the Traffic Monitor

The traffic monitor is one of the most essential tool of ProPort. This is where all the traffic is listed, and can be manually disconnected. By clicking on the "X" and filter buttons listed next to established traffic [image], users can choose to terminate or add a connection to the remote filter. Definitions of traffic monitor items:

State

The state of the connection (ex: Established, Time Wait, Closing..etc)

Local Port

This is the local port of the connection. In the case of a trojan, it would be the listening port on a victim's computer, set up to receive a connection from the Trojan client.

Remote IP

The remote address of the connection (IP : Port).

Remote Hostname

This may or may not list certain items, depending on ProPort's settings. The hostname is the name used for the IP, makes it easier to determine where a connection is coming from.


Process Manager

Using the Process Manager

The process manager will show all the current processes (loaded .dll and .exe files) on the users computer. The user can then choose a process and end it by clicking "End Process". Definitions of process manager items:

Process

This is the process's name and files location (usually the .exe or the DLL filename -- ex: system\kernel32.dll, proport.exe...etc).

Process ID

This is the ID of the running process. It is used to help ProPort locate and terminate the file.


Startup File Edittor

Using the Startup Edittor

Displayed on the left is a panel with all the possible startup methods available. By selecting one of them, the user can see what it being started, delete the method and/or delete the file.

Once a startup method has been selected, ProPort will then display the method name (this could be the keyname within the registry, or the item name within an .ini file), and the file being called by it. To delete it, simply select the method + file and click "Delete".

Shell Spawning Method:

This is a relatively unknown startup method. When the user clicks on it, the method column will display three items (EXE COM and BAT files). When these settings are normal, they should each display something like: "%1" %*. Don't get confused, that's normal. If they display something else, like "c:\server.exe %1", you have a problem. Let's say that the file "server.exe" is listed next to the method name EXE File. This means that whenever an .EXE file is executed on the computer, that server.exe file will be executed as well. This not only causes a vulnerability for Trojans, but will slow your computer considerably.


Directory Scanning

Using the Directory Scanner

Currently ProPort uses the TFAK (Trojan First AID Kit) file scanning engine (http://www.kryptocrew.de/snakebyte) thanks to SnakeByte. Simply put a check mark next to the directories that you wish to scan for trojans, and click "Start Scan". ProPort will then scan every file within that directory, as well as every file within the recursive subdirectories.

If a trojan is found while scanning, it will be displayed in the window on the right. The "Local File" is the full filename of the trojan (including path), and "Infected With" is the trojan name that the file is infected with. To the left of the local filename will be an X, similar to the one used in the traffic monitor. Simply click that X to delete the infected file. After ProPort deletes the infected file, it will automatically re-scan the previously selected directories to ensure that the file was deleted.


ProPort Settings

Changing ProPort's Settings

Changing ProPort's settings can be very useful. The list that is displayed to the left is of trojan names and their ports. Here you can add, edit and remove them from/to this list.

You can set ProPort's monitor to get hostnames and to use the remote filter (as well as in the toolbar), but also to show listening ports. Please note that listening ports will only appear when the monitor is set to display all the traffic.

You can change the type of traffic to monitor in the drop-down box labeled "Traffic to Monitor". It can be set to All, Established, Time Wait, SYN Sent and SYN Received.

You can also choose what ProPort does when it finds a potential attack happening, whether it be prompting the user, automatically killing the connection, or to just ignore it.

The "Minimize to" option is used when ProPort is minimized. You can set it to stay in the taskbar, or to just show in the system tray (next to the clock).


Remote Filtering

Using the Remote Filter

With the remote filter, users can set ProPort to exclude certain remote ports from monitoring. This is helpful to prevent failures in Web-browsing, or email checking..etc.

Remote filters can be entered as follows:
• FilterName:1234 (single)
• FilterName:1230-1232 (range)
• FilterName:1234;1237;1240 (series)

This first one will exclude any traffic that occurs on the remote port: 1234. The second on excludes any traffic that occurs on remote ports 1230, 1231 and 1232. The third will exclude traffic on 1234, 1237 and 1240.

IMPORTANT: Entering a remote filter like: FilterName:1230-1232;1234;1237 will NOT work. You can only enter either a range of ports (1-10), or a series of them, but not both.


Attack Log

Using the Attack Log

Every time an attack or intrusion occurs, and ProPort is able to disconnect it, it will be enter into the attack log. Users can clear the log, and save it to a text (.txt) file. Definitions of the attack log items:

Time

This item is obviously just the time that the attack took place.

Remote IP

This is the Remote IP of your attacker or intruder, helping you find out who is trying to attack you.

Port

This is the local port of the attack, in the case of a trojan, it's the port that is set up to listening for a connection on your computer.

Possible Trojan

The possible name of the attacking tool used by your attacker. It's determined off of the port used during the attack.


About HTMLHelp ePublisher

This eDocument Was Created Using:
HTMLHelp ePublisher
Electronic-Documentation Creation Made Easy

Free to Download From:
http://www.htmlhelp-epublisher.co.uk

Also Available Web2HTMLHelp (Freeware)