Re: Compromised Win2000 machine.

From: Daniel Hay (
Date: 05/29/02

Date: Wed, 29 May 2002 14:05:55 -0400
From: Daniel Hay <>
To: H C <>

>Danny took the typical action seen of most
>admins...port scanning the system from the outside,
>and comparing the open ports to lists of known trojans
>and services. This is inconclusive at best, and leads
>to a lot of speculation and time-wasting. Better to
>run fport on the system (if NT/2K...if the system is
>XP, run netstat w/ the '-o' switch) instead, to see
>the process to port mapping.

I took the only action i could given i don't have physical access to the
and still have not been able to contact the owner, we are currently just
watching traffic to and from the box
to see if we can see anything that may constitute a patter that could be
used to find other hosts on campus that have already or may be in the
future owned
by similar tools


This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: