the way to track that is not trough netstat (is too dependent on chance), but rather through a process/loaded dll list from an infected machine, being compared to a similar list on a known good machine and all non-matching entries researched. now then http://www.sysinternals.com/win9x/98utilities.shtml this should help you. also, what does the telescope look like (just curious). regards, IDS ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Oct 02 2002 - 13:48:19 PDT