Re: maybe a simple problem

From: Igor D. Spivak (urbanachiever@attbi.com)
Date: 10/02/02


From: "Igor D. Spivak" <urbanachiever@attbi.com>
To: "Andrew Fison" <afison@brit-tex.net>, <incidents@securityfocus.com>
Date: Wed, 2 Oct 2002 12:49:32 -0700

the way to track that is not trough netstat (is too dependent on chance),
but rather through a process/loaded dll list from an infected machine, being
compared to a similar list on a known good machine and all non-matching
entries researched.

now then http://www.sysinternals.com/win9x/98utilities.shtml this should
help you.
also, what does the telescope look like (just curious).

regards,

IDS

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com