Re: Analyzing Suspicious Attachment

[brian.bevers () gmail com]

I concur, once you suspect a comprimise, reimage that puppy. Of course making an image of the suspect systems for your 
analysis and joy :)

Setup some acl's on the perimeter firewall for those 3 IP's and watch what they try to do and go ??


Sent via BlackBerry by AT&T

-----Original Message-----
From: "Ali, Saqib" <docbook.xml () gmail com>

Date: Thu, 17 Jan 2008 09:53:02 
To:"Al Cooper" <cooper () hmcnetworks com>
Cc:security-basics () securityfocus com
Subject: Re: Analyzing Suspicious Attachment


> Outside of the obvious policy and training issues, what is the best way to
> determine what if any damage has been done to the network?  What tools do I
> need to analysis the attachment to see what it is and how it works?

i would backup just the "data" files from the computers, re-image the
machine, and then restore the data files.

you can never fully determine the extent of the damage, so it is
better to re-image the machine.....

saqib
http://www.quantumcrypto.de/dante/