Re: Compromised Win2000 machine.

[Mark Newby <mark () dranton com>]

H C wrote:
> [...]
> Danny took the typical action seen of most
> admins...port scanning the system from the outside,
> and comparing the open ports to lists of known trojans
> and services.  This is inconclusive at best, and leads
> to a lot of speculation and time-wasting.  Better to
> run fport on the system (if NT/2K...if the system is
> XP, run netstat w/ the '-o' switch) instead, to see
> the process to port mapping.
> [...]

...but I thought the advice for a (possibly) compromised box was *not* 
to run executable programs that resided on that host, as they can't be 
trusted?


mark



----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com