Solved

Windows Server 2003 hacked by the Chinese?

Posted on 2010-11-27
4
743 Views
Last Modified: 2012-05-10
I have a Windows 2003 server and I think I have a security issue with it. The default language was mysteriously changed to Chinese, I changed it back. I keep seeing lots of connections on my SonicWall to port 80 from all kinds of IP's from China. I already blocked lots of Chinese IP ranges on my SonicWall. I wish there was a network group object that i could import that contained all the country IP ranges of all the bad guys. At this current moment I don't see any Chinese connections but I'n not convinced this is fixed yet.

I noticed that the IUSER_WEB was a member of the Administrors group which sounds very fishy. I've disabled the IUSR_WEB account for the time being. This server also just passed a malwarebytes scan test and its all up the date on Microsoft updates. What is the default security assigned to the IUSR_WEB account? I need port 80 open on this machine since it does host a small webpage. Anything else I should be looking at?   Thanks!
0
Comment
Question by:crdixon
4 Comments
 
LVL 42

Accepted Solution

by:
kevinhsieh earned 250 total points
ID: 34224117
I think that the only safe thing to do is to wipe and restore from backup or wipe and rebuild. You can't trust anything on the system, not even GIF files.
0
 
LVL 5

Assisted Solution

by:Blake_1
Blake_1 earned 250 total points
ID: 34224245
Agree with the comment above.  To prevent a reoccurrence, ensure that your server is fully patched and antivirus current before presenting it to the Internet again.
0
 
LVL 68

Expert Comment

by:Qlemo
ID: 34421442
This question has been classified as abandoned and is being closed as part of the Cleanup Program.  See my comment at the end of the question for more details.
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
Lync server 2013 or Skype for business Backup Service Error ID 4049 – After File Share Migration
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
This tutorial gives a high-level tour of the interface of Marketo (a marketing automation tool to help businesses track and engage prospective customers and drive them to purchase). You will see the main areas including Marketing Activities, Design …

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now