Please help my IIS server has been hacked.

Ok I've been trying different things. That tool didn't come up with anyting on my machine but it was cool to have none the less.
It is very clear that no matter what I do I'm not going to be able to get this stuff off my computer. Norton AV hasn't found anything either and I updated to the latest definitions as well.
Thanks for the quick reply as well. What would you recommend for the future so that after I rebuild this server it wont happen again. How can I be sure that nothing on my backup tapes is infected with something?

I have had this happeded to me too. They upload movie files to you FTP site and you cannot delete the folders or the files, right? They called it "Tagged"

The reason you cannot delete these files is because they contain reserved Windows keywords, like com1, com2 etc.

Here is your answer, follow this document:

http://support.microsoft.com/default.aspx?scid=KB;en-us;q120716

** The best way to prevent this from happening to you again, is to not allow anonymous access to your ftp sites with write permission.

Let me know if you need more help with this.

- Hans

I forgot to mention... This kind of attack typicaly does not leave a payload. You don't have to worry about any virus, worm or backdoor left behind. Although, it is not a bad idea to do a full virus scan and install all the latest IIS patches (SP3 + post SP3).

Also download and use the IIS Lockdown tool. You can download it from:

http://www.microsoft.com/windows2000/downloads/recommended/iislockdown/default.asp

- Hans

Thanks for the help TKK, I had to go ahead and rebuild. I've learned quite a bit going through this mess and I don't think I can totaly keep them out but I feel like it's not going to be easy this time around either. Thanks for the links, good information.

Hi,

This is what happend to me:

http://www.hermitscave.org/forum/index.php?final_uri=.%2Fdiscussion.php%3Fmsg%3D7229.1

There I found answers about WAREZ directories:

http://www.windows2000faq.com/Articles/Index.cfm?ArticleID=14543

And this helped me a lot not to get the same problem again:

http://homepages.wmich.edu/~mchugha/w2kfirewall.htm

Best regards, Raisor

> This kind of attack typicaly does not leave a payload.
> You don't have to worry about any virus, worm or backdoor left behind.

Do you want to bet your job on that statement?
The hacker(s) "owned" your computer,
and unless you want to spent about a week
doing a forensic analysis of your computer,
you cannot prove that there are no "back-doors".
(What if the hacker configured and started the
TELNET-server on your computer -- the hacker
can get a command-line prompt on your computer
by simply entering:  telnet your.system 23456
if the TELNET-server is "listening" on port 23456.

You _must_ rebuild, and patch, if you want to keep your job.

Otta,

It sounds like you are holding on to dear life to your job. It's the way of the uneducated, uninformed and paranoid.

To answer your question, I will bet my job on my statement. As a matter of fact, I will bet my company on that statement.

Read the rest of the post and you will see “Although, it is not a bad idea to do a full virus scan and install all the latest IIS patches (SP3 + post SP3)."

The first time we ran into this problem, we analyzed the system for 9-days. 4 guys working on it, 2 of them specialists and well known and respected in the industry with more than 10-years of experience. I am sure that is way more than your limited knowledge.

"(What if the hacker configured and started the
TELNET-server on your computer -- the hacker
can get a command-line prompt on your computer
by simply entering:  telnet your.system 23456
if the TELNET-server is "listening" on port 23456."

Above is your ignorant statement... My dear friend, you can telnet to anything if the server is listening for connections on a open connection. What are you saying? Next you are probably going to tell me be careful and patch your web server because someone can connect to it on port 80?

I think you got the message. Now go write batch files or send an email.

Yours truly,

Hans

> Above is your ignorant statement

Ignorant -- how ignorant of you to use such
"non-professional" language in this professional forum.

I have seen "hacked" Windows 2000 servers.
The hacker modified the Windows Registry to start
the TELNET-server on a non-standard port.
So, anytime the hacker wanted, he/she could just
TELNET to that port, and get a command-line prompt,
namely 'C:\', with full administrative privileges
to once-again "hack" into the computer.





> we analyzed the system for 9-days.
> 4 guys working on it,
> 2 of them specialists and well known and respected
> in the industry with more than 10-years of experience.

It must be wonderful to have the time and resources
to waste 4 times 9 days times 7 hours times $50 per hour,
namely $12600, to do a forensic investigation.

> I am sure that is way more than your limited knowledge.

Even with my limited knowledge, I can predict that after
spending $12600, you still would decide to re-format and
then re-install everything.

My method would "save" my employer over $12 thousand dollars.

Any cost/benefit analyst would probably give me a promotion
for _initially_ making the _only_ correct decision,
namely to rebuild.

> I have had this happen to me
> They upload movie files to you FTP site
> and you cannot delete the folders or the files, right?

Use the 'rmdir' with the '/?' keyword to discover
the "secret" option to delete _BOTH_ the directory
_AND_ all the files (no matter what names they have)
inside that directory.

> They called it "Tagged"

No, you're very wrong.  

A "tagged" site contains a directory created by the
hacker, and the name of the directory contains the
nick-name of the hacker, and the time-stamp of the
directory proves that the hacker was the _FIRST_
hacker to "find" your very-insecure server.

Compare it to the first persons to climb Mount Everest;
they "tagged" the mountain, by leaving flags from their
countries on the top of the mountain, so that the next
person to complete the ascent would find their "tag".

Sounds to me like someone needs to switch from Micro$oft swiss cheese to a Linux product.

> switch to Linux:

well-known Linux vulnerabilities:
* http://www.sans.org/y2k/ramen.htm ("Ramen")
* http://www.sans.org/y2k/adore.htm ("Adore")
* http://www.sans.org/y2k/t0rn.htm  ("t0rn root-kit")
* http://www.incidents.org/react/lion.php ("l10n")

'nuff said.

Hans and Otta,

May I request that you two meet somewhere _else_ to continue your verbal assaults? This type of exchange is not _Expert_, lowers the apparant (to visitors) quality and professionalism of these forums, and frankly, makes me sick!

tnguy

Thanks for voicing your opinion. ApexTx's question has been answered - he selected an answer and we all said what we wanted to. Are you looking for browny points?

If any comunity support users see this, please give this guy 5-points to shut him up.

Who are you?? Where did you come from?? You're 5-weeks late!

Everyone that commented on this question is getting an email everytime you post something here. Quite frankly I'm getting sick receiving email related to this.

Tnguy, find something better to do with your time!

Otta sez:
"well-known Linux vulnerabilities:
* http://www.sans.org/y2k/ramen.htm ("Ramen")
* http://www.sans.org/y2k/adore.htm ("Adore")
* http://www.sans.org/y2k/t0rn.htm ("t0rn root-kit")
* http://www.incidents.org/react/lion.php ("l10n")

'nuff said."


Hm, 4 vulnerabilities versus about 10,000, and you have to pay for the priveledge to own the one with 10,000 and endure the snooping they do.  hm.  I don't know about you, but the free one is still the better deal, and way more reliable.  

'nuff said.

out.

> 4 vulnerabilities versus about 10,000,

I'm surprised that you didn't mention
http://WWW.TrustWorthyComputing.com
in your rant.  :-)

Who needs to??  The evidence is there.  Back when I got broadband (1997), I got hacked because my Windows box was vulnerable as hell.  I tried the Win98 connection sharing, but that was a failed bit as well, because it wasn't reliable at all.  So I drug out the old PackardBell P90, loaded Red Hat 5.x, set it up as a firewall, and that box ran constantly and uninterrupted until last month, when I swapped it for a Smoothwall box.  If that firewall was a Windows box, we *all* know it would've been hacked the second someone figured it out.  It would've crashed constantly, and would've bee infected almost immediately.  

So you tell me, which is the better OS?  Especially given M$'s penchant for snooping, compromising security, and monopolistic actions?  Can you *really* trust M$ to deliver a product that protects your privacy and rights, especially in the face of *their* profits??

I think we all know *that* answer!