Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Windows Server 2003 hacked by the Chinese?

Posted on 2010-11-27
4
Medium Priority
?
775 Views
Last Modified: 2012-05-10
I have a Windows 2003 server and I think I have a security issue with it. The default language was mysteriously changed to Chinese, I changed it back. I keep seeing lots of connections on my SonicWall to port 80 from all kinds of IP's from China. I already blocked lots of Chinese IP ranges on my SonicWall. I wish there was a network group object that i could import that contained all the country IP ranges of all the bad guys. At this current moment I don't see any Chinese connections but I'n not convinced this is fixed yet.

I noticed that the IUSER_WEB was a member of the Administrors group which sounds very fishy. I've disabled the IUSR_WEB account for the time being. This server also just passed a malwarebytes scan test and its all up the date on Microsoft updates. What is the default security assigned to the IUSR_WEB account? I need port 80 open on this machine since it does host a small webpage. Anything else I should be looking at?   Thanks!
0
Comment
Question by:crdixon
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 42

Accepted Solution

by:
kevinhsieh earned 1000 total points
ID: 34224117
I think that the only safe thing to do is to wipe and restore from backup or wipe and rebuild. You can't trust anything on the system, not even GIF files.
0
 
LVL 5

Assisted Solution

by:Blake_1
Blake_1 earned 1000 total points
ID: 34224245
Agree with the comment above.  To prevent a reoccurrence, ensure that your server is fully patched and antivirus current before presenting it to the Internet again.
0
 
LVL 71

Expert Comment

by:Qlemo
ID: 34421442
This question has been classified as abandoned and is being closed as part of the Cleanup Program.  See my comment at the end of the question for more details.
0

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Prologue It is often required to host multiple websites on a single instance of IIS, mostly in development environments instead of on production servers. I am sure it is not much a preferred solution on production servers but this is at least a pos…
Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
In this video, Percona Solution Engineer Dimitri Vanoverbeke discusses why you want to use at least three nodes in a database cluster. To discuss how Percona Consulting can help with your design and architecture needs for your database and infras…
Suggested Courses

664 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question