Don, > look under services, find all remote procedure > calls, look at the properties > of each one, specifically notating the actual path > to the called program, > liekly you'll find one of those do not go to the > winnt directory, stop that > service. You may want to go thru all of your > services that are active, and > look at the program name and location of the program > to make sure you > recognize all of them, the ones you dont, take a > little further look into. It's not clear why checking the services is the way to go on this...IMHO, I'd check the processes instead. Running tools like fport, netstat, handle, listdlls, and pslist will get a fairly complete snapshot of what's going on on the system, and then using a tool like procdmp.pl (http://patriot.net/~carvdawg/perl.html) to consolidate that info for easy viewing might be a better way to go. Danny took the typical action seen of most admins...port scanning the system from the outside, and comparing the open ports to lists of known trojans and services. This is inconclusive at best, and leads to a lot of speculation and time-wasting. Better to run fport on the system (if NT/2K...if the system is XP, run netstat w/ the '-o' switch) instead, to see the process to port mapping. __________________________________________________ Do You Yahoo!? Yahoo! - Official partner of 2002 FIFA World Cup http://fifaworldcup.yahoo.com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed May 29 2002 - 10:26:12 PDT