am I hacked?

Hi, I am using Windows 2000 with IIS. In the middle of the day, I realized that my web-site server is stopped. I tried to start it and I got an message like "address is alreaady in use"

I remove my IIS service from server completely but I still see that "port 80, port 21" is open on the server and when I try to connect using ftp port, it even ask me username and password with a microsoft FTP server message.

What is that? I dont understand. Am I hacked?

I dont have any other web server on the server. I had IIS and MSSQL. that's all..

Urgent help is needed. Thank you very much..
Who is Participating?
AbacusOnsiteConnect With a Mentor Commented:
Are your files still intact, or have they changed at all?  You could have just had a IIS web service hiccup.  When you say that you “realized” the web-server was down, do you mean that the web site was inaccessible, or that you looked at the service and noticed it was stopped, or you saw this from within IIS?

I believe that port 21 and 80 are open by default, otherwise you wouldn’t be able to view web pages or use an FTP program to download files from a server.  Normally, however, if anyone tries to connect to your computer at these ports, the connection is refused… unless, of course, you are hosting a web or FTP server.

Bottom line... I don't think you were hacked.
burningmaceConnect With a Mentor Commented:
Un-install the Webserver and FTP server, reboot and re-install. That should fix it.

I had the same problem and it turned out to be a faulty install.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.