Security Incidents mailing list archives

Re: Strange activity to a laptop?


From: Frank Knobbe <FKnobbe () KNOBBEITS COM>
Date: Fri, 6 Oct 2000 12:31:24 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

-----Original Message-----
From: Johnson, Greg [mailto:JohnsonG () MISSOURI EDU]
Sent: Friday, October 06, 2000 8:49 AM

Ralph, I've found these useful for similar investigations.

http://ntsecurity.nu/toolbox - Inzider in particular

http://www.sysinternals.com - Handle, TCPView

http://www.zdnet.com/downloads/stories/info/0,,000YKL,.html
  - Startup Cop reveals all levels of startup programs and
    lets you temporarily or permanently disable them.


I think you need to add TDIMon to the list of SysInternal tools. That
goes deeper into the stack and is extremely handy in finding tasks
and their ports.

Regards,
Frank

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.1
Comment: PGP or S/MIME encrypted email preferred.

iQA/AwUBOd4MbERKym0LjhFcEQJ6/wCfbeMTkBhOteiUs9q6k9MvcFJB7BMAn2Xv
aiZobe3DvhQ2Xki6UgcM4c6c
=XLzm
-----END PGP SIGNATURE-----


Current thread: