Re: Languard
From: karl [x y] (jamescagney90210@excite.com)
Date: 08/03/02
- Next message: Jeff Dumrauf: "Client based Certificates"
- Previous message: karl [x y]: "Re: Attacked by UNIX Rootkit"
- In reply to: Essary: "Languard"
- Next in thread: Atrax _: "Re: My server has been hacked"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "karl [x y]" <jamescagney90210@excite.com> Date: Fri, 2 Aug 2002 19:50:27 -0400
That Languard scanner is a good tool, but I'm not sure it was the tool I had
in mind. The file integrity checker [last time I looked] is hidden under
the "Languard White Paper" section.
Seems to me they also had a trojan scanner somewhere there as well. The
trojan scanner is described at www.sunbelt-software.com and there might be
a free trial download there as well. Or you might make it easy on yourself
and try the www.pestpatrol.com scanner instead, though their free download
scanner might be limited in function.
If you were hacked after installing all the Microsoft patches and installing
Norton, I'm guessing you also need to change the IIS settings by using
IISlockdown including URLscan and also going through the
www.microsoft.com/security IIS and Windows security checklists. If someone
is locking out your Windows password, then I'm guessing you also may not
have a firewall, because Windows networking traffic should not be able to
reach your server.
I can see from looking at your Fport results that you've got the following
services running that should be disabled [unless you need them]: SMTP mail
service, Telnet server, Terminal Services, and SNMP.
I'd also check into that file \??\C:\WINNT\system32\winlogon.exe mentioned
in the Fport results. I can't tell from here whether it is legitimate or
not. I might also suggest downloading the Forensic Toolkit from
foundstone.com and run sfind.exe [e.g. sfind c: ] to search for hidden file
streams.
"Essary" <essaryj@yahoo.com> wrote in message
news:022e01c23a51$79a45510$9be62ecf@tkmsftngxa03...
>-----Original Message-----
- Next message: Jeff Dumrauf: "Client based Certificates"
- Previous message: karl [x y]: "Re: Attacked by UNIX Rootkit"
- In reply to: Essary: "Languard"
- Next in thread: Atrax _: "Re: My server has been hacked"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
