RE: Please assist, tracking or IDS options.

[Clark, Steve]

Check to make sure you don’t have Nimda. If your firewall and servers are configured correctly, they should not be able to shutdown your server.   Steve Clark Clark Systems Support, LLC AVIEN Charter Member “Who's watching your network?” www.clarksupport.com           301-610-9584 voice           240-465-0323 Efax   The data furnished in connection with this document is deemed by Clark Systems Support, LLC., to contain proprietary and privileged information and shall not be disclosed or used for the benefit of others without the prior written permission of Clark Systems Support, LLC.   -----Original Message----- From: David Ng [mailto:[EMAIL PROTECTED]] Sent: Tuesday, October 23, 2001 8:14 PM To: [EMAIL PROTECTED] Subject: Please assist, tracking or IDS options. Importance: High   Dear all,     We have a NT network that was hit the other day, in the sense that it was remotely shutdown by an individual somehow. The person might have the passwords and also sound technical expertise in remote utilities. Is there a way for me to trace where the traffic was coming from that day and what IP address? Also, is there a way to automatically capture the screen if it was remotely controlled?     Please advise, thanks in advance.     Sincerely,       David Ng