Rcon trojan

From: Owen Creger (OCregerat_private)
Date: Mon Mar 04 2002 - 09:08:00 PST

Next message: Hugo van der Kooij: "Re: FYI - slow scans for https..."

Previous message: Russell Fulton: "FYI - slow scans for https..."
Next in thread: Hugo van der Kooij: "Re: Rcon trojan"
Reply: Hugo van der Kooij: "Re: Rcon trojan"
Reply: Tom Gerritsen: "Re: Rcon trojan"
Reply: H C: "Re: Rcon trojan"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

It appears one of our NT boxes has been compromised, and is running the rcon
trojan, port 8989
Does anyone know how to clean up the mess, or do I need to rebuild the box?

Owen C. Creger CCNA
Information Systems Security Engineer
Creative Solutions Inc.
7322 Newman Blvd.
Dexter, MI  48130
email: ocregerat_private
ph: 734-426-5860 ex. 3787
fax: 734-426-5946
cell: 734-223-6270


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Hugo van der Kooij: "Re: FYI - slow scans for https..."
Previous message: Russell Fulton: "FYI - slow scans for https..."
Next in thread: Hugo van der Kooij: "Re: Rcon trojan"
Reply: Hugo van der Kooij: "Re: Rcon trojan"
Reply: Tom Gerritsen: "Re: Rcon trojan"
Reply: H C: "Re: Rcon trojan"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Mar 04 2002 - 13:53:10 PST