RE: Application backdoor suspect

[Tony Fondo <Tony.Fondo () patlive com>]

for other *nix based, you can use lsof

-T
-----Original Message-----
From: Catfish [mailto:catfish () catfish homeip net]
Sent: Monday, December 16, 2002 12:20 AM
To: skp () sargam com; security-basics () securityfocus com
Subject: Re: Application backdoor suspect


You didn't say what os you are using, I'll assume windows...
Check out sysinternals for filemon and regmon. They let you see what the
program does with the registry and files in realtime.
Also check network sniffing programs to see what it sends out over the
network.

> My question is there a way to see what files the application is calling on
> during the synch process. I want to see what other info it is sending. Its
> troubling to know that the app is sending info that is not relevant to its
> starting up.