Determining Trojans, File & Print Sharing, Services running remotely on W2K

From: Jason (cisspstudyat_private)
Date: Thu May 09 2002 - 16:03:02 PDT

  • Next message: Arturo \: "Re: Arp spoofing & dsniff"

    
     ('binary' encoding is not supported, stored as-is)
    I will be performing a workstation audit on 300 W2k 
    workstations across the network.
    
    I need to scan to see:
    1. If there are any trojans running on these hosts.
    2. Whether shares are activated on these hosts.
    3. Whether anti-virus is installed.
    
    I will have domain administrator rights and all 
    workstations are in the windows NT 4.0 domain.
    
    What tools do people recommend for performing each of these 
    steps? I will be scanning for workstations within a 
    specific IP range.
    
    For Trojan Scanning I have seen tools like TFAK. But I am 
    not sure how good it is and I know it can't be run on a 
    block of IP's.
    
    For determining whether shares are activated maybe I could 
    use something like Legion ?
    
    For determining whether anti-virus is installed I need a 
    tool that can dump a list of services running on a remote 
    host for a block of IP addresses.
    
    Any help appreciated.
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
    Service. For more information on SecurityFocus' SIA service which
    automatically alerts you to the latest security vulnerabilities please see:
    https://alerts.securityfocus.com/
    



    This archive was generated by hypermail 2b30 : Fri May 10 2002 - 09:02:51 PDT