Newsgroup: it.comp.os.win.win2000
Titolo: Firewall e sicurezza

Secondo voi che significa un messaggio del genere del Firewall?
The executable has changed since the last time you used:
C:\WINNT\system32\LSASS.EXE
File Version :		5.00.2195.5960
File Description :	DLL eseguibile e server LSA
File Path :		C:\WINNT\system32\LSASS.EXE
Process ID :		100 (Heximal) 256 (Decimal)
Connection origin :	remote initiated
Protocol :		UDP
Local Address : 	80.116.127.166
Local Port :		500 (ISAKMP - Internet Security Association
and Key Management/IPSEC Key Exchange)
Remote Name :			
Remote Address :	80.105.76.53
Remote Port : 		500 
Ethernet packet details:
Ethernet II (Packet Length: 914)
	Destination: 	00-00-02-00-00-00
	Source: 	f0-cf-20-00-02-00
Type: IP (0x0800)
Internet Protocol
	Version: 4
	Header Length: 20 bytes
	Flags:
		.0.. = Don't fragment: Not set
		..0. = More fragments: Not set
	Fragment offset:0
	Time to live: 120
	Protocol: 0x11 (UDP - User Datagram Protocol)
	Header checksum: 0x3d71 (Correct)
	Source: 80.105.76.53
	Destination: 80.116.127.166
User Datagram Protocol
	Source port: 500
	Destination port: 500
	Length: 8
	Checksum: 0x6ad0 (Correct)
Data (880 Bytes)
Binary dump of the packet:
0000:  00 00 02 00 00 00 F0 CF : 20 00 02 00 08 00 45 00 | ........
.....E.
0010:  03 84 61 73 00 00 78 11 : 71 3D 50 69 4C 35 50 74 |
..as..x.q=PiL5Pt
0020:  7F A6 01 F4 01 F4 03 70 : D0 6A 2C 5F 03 10 FC 48 |
.......p.j,_...H
0030:  85 48 00 00 00 00 00 00 : 00 00 01 10 02 00 00 00 |
.H..............
0040:  00 00 00 00 03 68 0D 00 : 03 34 00 00 00 01 00 00 |
.....h...4......
0050:  00 01 00 00 03 28 01 01 : 00 08 03 00 00 64 01 01 |
.....(.......d..
0060:  00 00 80 01 00 05 80 02 : 00 02 80 04 00 02 80 03 |
................
0070:  FD E9 80 0B 00 01 00 0C : 00 04 00 00 70 80 7D 01 |
............p.}.
0080:  00 3C 67 00 69 00 75 00 : 73 00 77 00 69 00 6E 00 |
.<g.i.u.s.w.i.n.
0090:  24 00 40 00 4D 00 45 00 : 43 00 43 00 41 00 4E 00 |
$.@.M.E.C.C.A.N.
00A0:  4F 00 47 00 52 00 41 00 : 46 00 49 00 43 00 4F 00 |
O.G.R.A.F.I.C.O.
00B0:  2E 00 4C 00 4F 00 43 00 : 41 00 4C 00 00 00 03 00 |
..L.O.C.A.L.....
00C0:  00 64 02 01 00 00 80 01 : 00 05 80 02 00 02 80 04 |
.d..............
00D0:  00 02 80 03 FD E9 80 0B : 00 01 00 0C 00 04 00 00 |
................
00E0:  70 80 40 00 00 3C 67 00 : 69 00 75 00 73 00 77 00 |
p.@..<g.i.u.s.w.
00F0:  69 00 6E 00 24 00 40 00 : 4D 00 45 00 43 00 43 00 |
i.n.$.@.M.E.C.C.
0100:  41 00 4E 00 4F 00 47 00 : 52 00 41 00 46 00 49 00 |
A.N.O.G.R.A.F.I.
0110:  43 00 4F 00 2E 00 4C 00 : 4F 00 43 00 41 00 4C 00 |
C.O...L.O.C.A.L.
0120:  00 00 03 00 00 64 03 01 : 00 00 80 01 00 05 80 02 |
.....d..........
0130:  00 01 80 04 00 02 80 03 : FD E9 80 0B 00 01 00 0C |
................
0140:  00 04 00 00 70 80 7D 01 : 00 3C 67 00 69 00 75 00 |
....p.}..<g.i.u.
0150:  73 00 77 00 69 00 6E 00 : 24 00 40 00 4D 00 45 00 |
s.w.i.n.$.@.M.E.
0160:  43 00 43 00 41 00 4E 00 : 4F 00 47 00 52 00 41 00 |
C.C.A.N.O.G.R.A.
0170:  46 00 49 00 43 00 4F 00 : 2E 00 4C 00 4F 00 43 00 |
F.I.C.O...L.O.C.
0180:  41 00 4C 00 00 00 03 00 : 00 64 04 01 00 00 80 01 |
A.L......d......
0190:  00 05 80 02 00 01 80 04 : 00 02 80 03 FD E9 80 0B |
................
01A0:  00 01 00 0C 00 04 00 00 : 70 80 40 00 00 3C 67 00 |
........p.@..<g.
01B0:  69 00 75 00 73 00 77 00 : 69 00 6E 00 24 00 40 00 |
i.u.s.w.i.n.$.@.
01C0:  4D 00 45 00 43 00 43 00 : 41 00 4E 00 4F 00 47 00 |
M.E.C.C.A.N.O.G.
01D0:  52 00 41 00 46 00 49 00 : 43 00 4F 00 2E 00 4C 00 |
R.A.F.I.C.O...L.
01E0:  4F 00 43 00 41 00 4C 00 : 00 00 03 00 00 64 05 01 |
O.C.A.L......d..
01F0:  00 00 80 01 00 01 80 02 : 00 02 80 04 00 01 80 03 |
................
0200:  FD E9 80 0B 00 01 00 0C : 00 04 00 00 70 80 7D 01 |
............p.}.
0210:  00 3C 67 00 69 00 75 00 : 73 00 77 00 69 00 6E 00 |
.<g.i.u.s.w.i.n.
0220:  24 00 40 00 4D 00 45 00 : 43 00 43 00 41 00 4E 00 |
$.@.M.E.C.C.A.N.
0230:  4F 00 47 00 52 00 41 00 : 46 00 49 00 43 00 4F 00 |
O.G.R.A.F.I.C.O.
0240:  2E 00 4C 00 4F 00 43 00 : 41 00 4C 00 00 00 03 00 |
..L.O.C.A.L.....
0250:  00 64 06 01 00 00 80 01 : 00 01 80 02 00 02 80 04 |
.d..............
0260:  00 01 80 03 FD E9 80 0B : 00 01 00 0C 00 04 00 00 |
................
0270:  70 80 40 00 00 3C 67 00 : 69 00 75 00 73 00 77 00 |
p.@..<g.i.u.s.w.
0280:  69 00 6E 00 24 00 40 00 : 4D 00 45 00 43 00 43 00 |
i.n.$.@.M.E.C.C.
0290:  41 00 4E 00 4F 00 47 00 : 52 00 41 00 46 00 49 00 |
A.N.O.G.R.A.F.I.
02A0:  43 00 4F 00 2E 00 4C 00 : 4F 00 43 00 41 00 4C 00 |
C.O...L.O.C.A.L.
02B0:  00 00 03 00 00 64 07 01 : 00 00 80 01 00 01 80 02 |
.....d..........
02C0:  00 01 80 04 00 01 80 03 : FD E9 80 0B 00 01 00 0C |
................
02D0:  00 04 00 00 70 80 7D 01 : 00 3C 67 00 69 00 75 00 |
....p.}..<g.i.u.
02E0:  73 00 77 00 69 00 6E 00 : 24 00 40 00 4D 00 45 00 |
s.w.i.n.$.@.M.E.
02F0:  43 00 43 00 41 00 4E 00 : 4F 00 47 00 52 00 41 00 |
C.C.A.N.O.G.R.A.
0300:  46 00 49 00 43 00 4F 00 : 2E 00 4C 00 4F 00 43 00 |
F.I.C.O...L.O.C.
0310:  41 00 4C 00 00 00 00 00 : 00 64 08 01 00 00 80 01 |
A.L......d......
0320:  00 01 80 02 00 01 80 04 : 00 01 80 03 FD E9 80 0B |
................
0330:  00 01 00 0C 00 04 00 00 : 70 80 40 00 00 3C 67 00 |
........p.@..<g.
0340:  69 00 75 00 73 00 77 00 : 69 00 6E 00 24 00 40 00 |
i.u.s.w.i.n.$.@.
0350:  4D 00 45 00 43 00 43 00 : 41 00 4E 00 4F 00 47 00 |
M.E.C.C.A.N.O.G.
0360:  52 00 41 00 46 00 49 00 : 43 00 4F 00 2E 00 4C 00 |
R.A.F.I.C.O...L.
0370:  4F 00 43 00 41 00 4C 00 : 00 00 00 00 00 18 1E 2B |
O.C.A.L........+
0380:  51 69 05 99 1C 7D 7C 96 : FC BF B5 87 E4 61 00 00 |
Qi...}|......a..
0390:  00 02                   :                         | ..

 Remote Port : 500
Un tentativo di connessione Ipsec?

 Process ID : 100 (Heximal) 256 (Decimal)
Ricordo un programmino che sfrutta le API win32 (e LSASS ne fa uso) per
elevare l'utente a "System Level" questo gli permette di eseguire dei
programmini dall'interno del server.
mi sembra sia hk.exe.