Security Incidents: Re: maybe a simple problem

["Igor D. Spivak" <urbanachiever () attbi com>]

the way to track that is not trough netstat (is too dependent on chance),
but rather through a process/loaded dll list from an infected machine, being
compared to a similar list on a known good machine and all non-matching
entries researched.

now then http://www.sysinternals.com/win9x/98utilities.shtml this should
help you.
also, what does the telescope look like (just curious).


regards,


IDS


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com