Avatar of ahfaris
ahfaris asked on

my windows 2003 hacked

i have windows 2003 standard server , but i have aproblem when i leave the pc on and return again to it , see that it seemed to be hacked , when i type netstat -n in command i see this :
             my pc                            foreign ips
 TCP    217.21.8.173:4862      217.21.8.131:139       ESTABLISHED
 TCP    217.21.8.173:4865      217.21.8.19:139        ESTABLISHED
 TCP    217.21.8.173:4866      217.21.8.48:135        ESTABLISHED
 TCP    217.21.8.173:4867      217.21.8.7:139         ESTABLISHED
 TCP    217.21.8.173:4869      217.21.8.133:135       ESTABLISHED
 TCP    217.21.8.173:4871      217.21.8.48:139        ESTABLISHED
 TCP    217.21.8.173:4873      217.21.8.133:135       ESTABLISHED
 TCP    217.21.8.173:4875      217.21.8.162:139       ESTABLISHED
 TCP    217.21.8.173:4877      217.21.8.41:139        ESTABLISHED
 TCP    217.21.8.173:4878      217.21.8.38:139        ESTABLISHED
 TCP    217.21.8.173:4879      217.21.8.162:445       ESTABLISHED
 TCP    217.21.8.173:4880      217.21.8.71:139        ESTABLISHED
 TCP    217.21.8.173:4883      217.21.8.133:139       ESTABLISHED
 TCP    217.21.8.173:4887      217.21.8.48:135        ESTABLISHED
 TCP    217.21.8.173:4893      217.21.8.172:139       ESTABLISHED
 TCP    217.21.8.173:4894      217.21.8.48:139        ESTABLISHED
 TCP    217.21.8.173:4897      217.21.8.73:135        ESTABLISHED
 TCP    217.21.8.173:4898      217.21.8.45:139        ESTABLISHED
 TCP    217.21.8.173:4900      217.21.8.74:139        ESTABLISHED
 TCP    217.21.8.173:4901      217.21.8.45:139        ESTABLISHED
 TCP    217.21.8.173:4902      217.21.8.46:139        ESTABLISHED
 TCP    217.21.8.173:4904      217.21.8.68:139        ESTABLISHED
 TCP    217.21.8.173:4907      217.21.8.51:139        ESTABLISHED
 TCP    217.21.8.173:4912      217.21.8.169:139       ESTABLISHED
 TCP    217.21.8.173:4913      217.21.8.63:135        ESTABLISHED
 TCP    217.21.8.173:4914      217.65.222.222:2745    SYN_SENT
 TCP    217.21.8.173:4921      217.21.8.63:139        ESTABLISHED
 TCP    217.21.8.173:4922      217.21.8.24:139        ESTABLISHED

and many lines like this , i have symantec antivirus updated , but i deont what is the probelm ? please help me
Operating Systems

Avatar of undefined
Last Comment
jrleds2003

8/22/2022 - Mon
sirbounty

What do you have for a firewall?  If nothing, you should certainly consider either a hardware or software variety (like Zone Alarm from www.zonelabs.com)

These links Check for Spyware:
  Spybot-S&D -->  http://www.safer-networking.org/
  HijackThis -->  http://www.spychecker.com/program/hijackthis.html
  Ad-Aware -->    http://www.netsecurity.about.com/library/blfreespyware.htm
  Web Shredder--> http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder
  Pest Patrol --> http://www.pestpatrol.com/downloads/eval/download.asp
  PCHell removal->http://www.pchell.com/support/spyware.shtml

  Make sure that after downloading these, that you update them.  It helps to try at least two of these.
  If all else fails, download HijackThis and post the log that is generated after running it on your system.
MikProg

You netstat log is a log of running server with attached users (if you run server attached to network. If you run server not attached to net i can't fugure out way to hack you server)
pafeto

They are probably a log for active conections in your own network. Check the IP´s and you will see that they correspond to computers in your own network. I do not think you should be worried about it.
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
Luniz2k1

TCP Ports 135/139/445 are all associated with File/Printer sharing.  If that PC has any drives or printers shared, or is connected to other PC's via file/printer shares, then you will see items like those in the netstat.
SunBow

I think I agree that you are simply looking at your local LAN connections, check out the following and try to become familiar with them:

inetnum:      217.21.8.0 - 217.21.8.255
netname:      HISNET
descr:        Alhoda Internet Services
descr:        PIS POP KhanYounis Area
country:      PS
admin-c:      AA700-RIPE
tech-c:       WK4085-RIPE
status:       ASSIGNED PA
notify:       walid@p-i-s.com
mnt-by:       PIS-MNTNER
changed:      walid@p-i-s.com 20020308
source:       RIPE

route:        217.21.0.0/20
descr:        PIS-NET
origin:       AS16029
mnt-by:       PIS-MNTNER
changed:      walid@p-i-s.com 20040311
source:       RIPE

person:       Ahmed Al-Agha
address:      Alhoda Internet Services
address:      Khan-Younis - Gaza
address:      Palestine
e-mail:       agha@p-i-s.com
phone:        +972 8 2053341
notify:       walid@p-i-s.com
mnt-by:       PIS-MNTNER
nic-hdl:      AA700-RIPE
changed:      walid@p-i-s.com 20020227
source:       RIPE

person:       Walid Kassab
address:      Palestinian Internet Services
address:      P. O. BOX 5111 Gaza City, Palestine
phone:        +972 8 284 3197
fax-no:       +972 8 284 3187
e-mail:       walid@p-i-s.com
nic-hdl:      WK4085-RIPE
mnt-by:       PIS-MNTNER
changed:      walid@p-i-s.com 20020227
source:       RIPE
shahrial

Normal connection except for port 2745...could be ... W32.Beagle.J@mm virus.
It may be compromised...see link for details.
http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle.j@mm.html

Corrective Action:
1.) Dowload the program below. After downloading these, update them.  Try it both.
- Spybot-Search & Destroy >  http://www.safer-networking.org/
- Lavasoft Ad-Aware 6 > http://www.netsecurity.about.com/library/blfreespyware.htm
Note: This will remove the spywares...

2.) Download the removal tool and run it on your server.
http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle@mm.removal.tool.html
Update your antivirus and run a full system scan. (preferbly with the network cable detached).

Hope it helps...
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
ASKER
ahfaris

i found that there is afile that is running in my pc its name is sysconf.exe , i think it is atrange file , after it , all connection to my pc was stoped except those that connect to port 135 on my pc , i tried to install zone alaram but it doesnot support win2003 , what can i do , i knew that it may be blaster worm but i have installed the patch for this worm before , what can i do to stop this problem
ASKER CERTIFIED SOLUTION
emisery

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Hondy

You should really avoid posting your IP address as you are advertising a big hole in your server unless of course you disguised it ;)  - It may be fixed now but in future you should do a "find and replace" in WordPad or something and replace with XX's
ASKER
ahfaris

ok thanks
Your help has saved me hundreds of hours of internet surfing.
fblack61
jhsmith67

Another useful tool (besides a firewall.....) is a program called spybot at http://www.safer-networking.org. They have been under attack lately from hackers so the website has been sporadic but you know it must be good if hackers are trying to stop it!!!

Regards,
Jeff
jrleds2003

That comment on not posting your full iP that has been compromised is just plain good sense.  Be cautious people!  Most of us are here to help, but there are some people who are bored or just looking for easy targets.  Post wisely.