Another bit of info... On Windows XP you could use netstat -b to get the name of the executable that has the connection open. Of course, they could rename the executable to circumvent that as well. But while we're talking about netstat...