Re: NT Compromise

[Paulo Braga <pbx2k () yahoo com>]

--- Eric Hines <eric3+ () pitt edu> wrote:
> Hey all,
>
> I am responding to several compromised NT boxes and
> am trying to find a
> utility that will allow you to see what program is
> bound to a particular
> port. I think I've seen one that shows what ports
> are bound to
> command.com, but need something similar for other
> programs/trojans/etc.
> Is there something available? 

Eric,

Try Fport, from Foundstone:

http://www.foundstone.com/rdlabs/tools.php?category=Forensic

I hope this helps!

Paulo Braga



__________________________________________________
Do You Yahoo!?
Check out Yahoo! Shopping and Yahoo! Auctions for all of
your unique holiday gifts! Buy at http://shopping.yahoo.com
or bid at http://auctions.yahoo.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com