Full Disclosure mailing list archives

Possible Comprimised IIS 5 on Win2k help

From: James.McDermott () ny frb org
Date: Wed, 24 Mar 2004 12:02:59 -0500

I think my IIs 5.0(Win2k) Server has been comprimised. I would like to do 
some forensics on it to find out how the person got in. I dont want to 
re-image the machine and find out he setup a backdoor threw the code and 
not the o/s

Current thread:

Possible Comprimised IIS 5 on Win2k help James . McDermott (Mar 24)
- RE: [inbox] Possible Comprimised IIS 5 on Win2k help Curt Purdy (Mar 24)
- Re: Possible Comprimised IIS 5 on Win2k help Ben Timby (Mar 24)
  - Re: Possible Comprimised IIS 5 on Win2k help Harlan Carvey (Mar 24)