fport : Port Scanner

fport is a creation of foundstone. For information on how to download it go to the tools to detect hacking page.
Download fport in your C:\ drive.
Here is a picture of what you might see if you had Malware and used fport to see it:




The reason fport is superior to netstat is that it not only shows the ports that the worm is attempting to access but also the protocol and the application or malware. Once you know the name of the process you can use Task Manager to shut if off. Some apps/malware run as a system process and can only be deleted in Safe Mode.
You will need to access the Command Prompt to use fport.
To get to the Command Prompt go to Start | Run | type "cmd"
The Command Prompt may automatically put you in your home directory. You'll need to be in the C:\ to use fport (actually, you'll need to be in whatever folder you downloaded fport in).
Once in the same folder as fport type "fport."
fport will list network connections and all the applications using them.
MORE ON FPORT:
FPort v1.33 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
http://www.foundstone.com
Usage:
/p sort by port
/a sort by application
/i sort by pid
/ap sort by application path

what process is using a TCP port in Windows

You may find yourself frequently going to network tools to determine traffic patterns from one server to another; Windows Servers (and earlier versions of Windows OS) can allow you to get that information locally on its connections. You can combine the netstat and tasklist commands to determine what process is using a port on the Windows Server.

The following command will show what network traffic is in use at the port level:

Netstat -a -n -o

The -o parameter will display the associated process identifier (PID) using the port. This command will produce an output similar to what is in Figure 1.

Figure 1

With the PIDs listed in the netstat output, you can follow up with the Windows Task Manager (taskmgr.exe) or run a script with a specific PID that is using a port from the previous step. You can then use the tasklist command with the specific PID that corresponds to a port in question. From the previous example, ports 5800 and 5900 are used by PID 1812, so using the tasklist command will show you the process using the ports. Figure 2 shows this query.

Figure 2

This identifies VNC as the culprit to using the port. While a quick Google search on ports could possibly obtain the same result, this procedure can be extremely helpful when you’re trying to identify a viral process that may be running on the Windows Server.

 Else You can use Netstat -b to get the full task details like Port number and related PID of a Application or Image name