Re: Web server crashed, now is trying to contact an IP by port 80 every morning.

Hi Dan,

I'd monitor which process initiates the transfer by using a program such as FPORT.

http://www.mamma.com/Mamma?timeout=4&lang=1&affiliate_id=9282&query=fport

Then you can terminate the process and delete the executable, etc.

If you can't terminate the process because it has SYSTEM privileges, start the Task Manager with an AT command (set it for two minutes into the future). Task Manager will then also be running as SYSTEM, and allow you to kill the process.

Cheers for now.
Stuart

On 23 Feb 2003 at 21:20, Dan Harpold wrote:

Subject:        	Web server crashed, now is trying to contact an IP by port 80 every morning.
Date sent:      	Sun, 23 Feb 2003 21:20:01 -0600
From:           	"Dan Harpold" 
To:             	

> My web server crashed the other day. Got a blue screen and on reboot

-- 
Stuart Udall
stuart(at)cyberdelix.net - 
http://www.cyberdelix.net/
..revolution through evolution

want to make some cash? check out 
http://cyberdelix.net/affiliates.htm


----------------------------------------------------------------------------

Lose another weekend managing your IDS?
Take back your personal time.
15-day free trial of StillSecure Border Guard.
http://www.securityfocus.com/stillsecure"> 
http://www.securityfocus.com/stillsecure 

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek