I'll just focus on one aspect of this problem, others will probably offer you other very useful input relating to specific trojan's, etc. For one thing, I'd recommend, in general, using a network sniffer so that you can see what, if anything, is leaving your machine to/from those IP addresses, especially during bootup. In general, whenvever you suspect anything network-borne on a machine, the first best thing is to look at the wire and see what's happenning. While you can put the analyzer on the same machine you have concerns with, in general it's best to put it another machine. Setup another machine with Ethereal (http://www.ethereal.org) of if you want a commercial product, you could consider http://www.tamos.com. Get a hub (not a switch) if possible and put your machine on that hub. Put the network analyzer on the hub. If this is a dial-up connection, you have several options but the first one (which may not be forensically-sound), would be to run the analyzer on your own machine. Regards, Eric ---------------------------------- Mission Critical Security Planner: When hackers won't take no for an answer http://www.amazon.com/exec/obidos/ASIN/0471211656 -----Original Message----- From: Patrick Fish [mailto:patrickat_private] Sent: Monday, February 10, 2003 5:12 AM To: incidentsat_private Subject: Suspicious file on Desktop Hi, I've been trying to figure out why there is a "Startup.log" file on my desktop. I've searched mail archives and google, but didn't find anything about this. The file contains: (Last octet of IP removed) CONNECTION: [01/26/03 21:50 UTC] 62.163.176.xx CONNECTION: [01/26/03 21:56 UTC] 67.192.41.xxx CONNECTION: [01/26/03 22:01 UTC] 67.192.41.xxx CONNECTION: [02/06/03 08:46 UTC] 65.65.81.xxx CONNECTION: [02/06/03 08:46 UTC] 65.65.81.xxx CONNECTION: [02/06/03 08:49 UTC] 80.194.40.xxx CONNECTION: [02/06/03 09:06 UTC] 144.134.163.xx CONNECTION: [02/06/03 09:11 UTC] 216.249.81.xx CONNECTION: [02/06/03 09:46 UTC] 136.165.87.xxx CONNECTION: [02/06/03 09:47 UTC] 211.28.63.xxx After resolving a few of them, these are all people I know pretty well on IRC. I can't figure out what's causing this - I don't use a mIRC script, I don't have a firewall (XP firewall is disabled) -- I do have Norton 2003 Pro. I'm using Windows XP Pro on Service Pack 1a, but the file was created before I installed SP1a I've checked my process list, and there's nothing running that shouldn't be. Has anything seen something similar or know what's causing this? Thanks. -- Patrick Fish ------------------------------------------------------------------------ ---- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Feb 10 2003 - 11:50:49 PST