[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-Disclosure] Possible Comprimised IIS 5 on Win2k help

To: full-disclosure@xxxxxxxxxxxxxxxx
Subject: [Full-Disclosure] Possible Comprimised IIS 5 on Win2k help
From: James.McDermott@xxxxxxxxxx
Date: Wed, 24 Mar 2004 12:02:59 -0500

I think my IIs 5.0(Win2k) Server has been comprimised. I would like to do 
some forensics on it to find out how the person got in. I dont want to 
re-image the machine and find out he setup a backdoor threw the code and 
not the o/s

Follow-Ups:
- RE: [inbox] [Full-Disclosure] Possible Comprimised IIS 5 on Win2k help
  - From: Curt Purdy
- Re: [Full-Disclosure] Possible Comprimised IIS 5 on Win2k help
  - From: Ben Timby

Prev by Date: [Full-Disclosure] rident.pl 0.9 file "deletion" and PID files modification
Next by Date: RE: [Full-Disclosure] Microsoft Coding / National Security Risk
Previous by thread: [Full-Disclosure] rident.pl 0.9 file "deletion" and PID files modification
Next by thread: RE: [inbox] [Full-Disclosure] Possible Comprimised IIS 5 on Win2k help
Index(es):
- Date
- Thread