hack problem

Posted on 2004-08-30
Last Modified: 2010-04-14

this morning, I found the D drive of our exchange server is 13 GB data more than usual.
Someone upload a lot of music file...

I also fould folder called emule...there is a thread is system called emule.exe, and I can not stop I could not delete the files on my hard disk

Please help me!
Question by:robinyanwang
  • 3
  • 3
  • 2
  • +1
LVL 32

Expert Comment

by:Luc Franken
ID: 11936035
Hi robinyanwang,

yes, it sure looks like you've been hacked :(

Please download Killbox:

And set it to delete emule.exe on the next reboot, this will make sure it isn't running on your system after a reboot.
Now, try deleting the mess.

Afterwards, you will have to check if you're still having any problems, maybe a backdoor was installed.
Try a tool like trojan hunter =>
The free trial will do fine for identifying.

If that doesn't work, do a full virusscan using one of the online virusscanners (don't trust on your installed one at this moment) 



Expert Comment

ID: 11936069

yes this is a downloader for Kazza and others, first i would look the remove and install programs for eMule and try to remove it. if that doesn't work let us know.

hope that this helps

Author Comment

ID: 11936478

just 5 mins, it is gone!!!

I deleted some files, folders under that folder (the hacker created),..

maybe he noticed that, so , just 5 mins ago, all 13 GB is gone!

also I can not find the emule.exe in the system thread.

Will he come back? how to stop it? he seems a good man, right?

Expert Comment

ID: 11936503
1. have you got all the latest MS updates
2. are you running any antivirus software
3. are you using a firewall

let us know
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

LVL 32

Expert Comment

by:Luc Franken
ID: 11936505
But as that was possible still indicates that someone has full control on your server :(
So what I still suggest you is to check your system for trojans, virusses etc.

Author Comment

ID: 11936565
ok, I will do it after working hours in the night.

I will let you guys know if I have any thing wrong.

thanks a lot for your quick reply!

Assisted Solution

BigC666 earned 150 total points
ID: 11936569
you bet

just let us know
LVL 32

Accepted Solution

Luc Franken earned 350 total points
ID: 11936590
Ditto :)

If you're unsure, let us check your running processes.
(as it's 0:17 here I'm going to sleep soon, but I'm sure BigC666 will be able to help you in the time between)

Good luck,


Expert Comment

ID: 11936974
I wouldn't take the chance, rebuild that box from scratch.  

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Fine Tune your automatic Updates for Ubuntu / Debian
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
A company’s greatest vulnerability is their email. CEO fraud, ransomware and spear phishing attacks are the no1 threat to a company’s security. Cybercrime is responsible for the largest loss of money to companies today with losses projected to r…

948 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now