Re: Port Zero
Harlan Carvey <[email protected]>
| Newsgroups | gmane.comp.security.incidents |
|---|---|
| Message-ID | <[email protected]> |
> I had in incident yesterday (18 June 2005), where a > client's Windows box listed almost every possible > port as open, listening in the same way described > above. Similiar netstat -an output as above. From my > experience this isn't normal. > > A few hours later the machine rapidly starting > sending packets to random addresses on port 443. > > What could this possibly be? Is it a > virus/backdoor/something malicious? Well, there is a way to find out. One tool to use is Foundstone's fport.exe, but I prefer DiamondCS's openports.exe. These tools are used for process-to-port mapping; ie, determining which processes on the system are using which port. If the client's system is/was Windows XP, take a look at the output of "netstat /?", paying particular attention to the '-o' and '-b' options. Harlan ------------------------------------------ Harlan Carvey, CISSP "Windows Forensics and Incident Recovery" http://www.windows-ir.com http://windowsir.blogspot.com ------------------------------------------