Re: maybe a simple problem

From: Igor D. Spivak (
Date: 10/02/02

From: "Igor D. Spivak" <>
To: "Andrew Fison" <>, <>
Date: Wed, 2 Oct 2002 12:49:32 -0700

the way to track that is not trough netstat (is too dependent on chance),
but rather through a process/loaded dll list from an infected machine, being
compared to a similar list on a known good machine and all non-matching
entries researched.

now then this should
help you.
also, what does the telescope look like (just curious).



This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: