Be careful of svchost. ServUFTPD is often renamed svchost.exe to hide it from less knowledgeable people. To check to see if you have one running, search for "svchost.exe" and check the file size. If you find one that around 496K, you're running a warez site. (Normal size is 8 to 14k, depending upon file version. Fully patched WinXP SP1 is 13k.)
Paul Schmehl ([EMAIL PROTECTED]) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/~pauls/ > -----Original Message----- > From: Joey [mailto:[EMAIL PROTECTED] > Sent: Wednesday, August 13, 2003 2:56 PM > To: [EMAIL PROTECTED] > Subject: RE: [Full-Disclosure] ISS Security Brief: "MS Blast" > MSRPC DCOM Worm Propagation (fwd) > > > svchost.exe listens on several ports on windows xp. > If microsoft is saying that it should never be on the > internet, couldn't there be more b0f's discovered in > the future? One peculiar service "DNS Client", > although listening on a few random ports just about > 1024, also runs off of svchost.exe. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
