Solved

cant access server shares after being hacked

Posted on 2014-01-14
3
277 Views
Last Modified: 2014-01-14
looks like one of my servers was hacked and has been used to mine bit coins..

this has all been cleaned up but the problem Im having is I cant \\servername or \\ipaddress to the server shares on the sbs2011 server.

(I can \\servername on the server itself and it works fine )

when I try from a windows 7 pc I get windows cannot access \\servername when I do the diagnostics the problem found says  the remote device or resource won't accept the connection.

on the windows 7 pc I can ping the server fine with either the server name or the ip address.

anyone got any ideas???

Thanks in advance
0
Comment
Question by:ibexsystems
  • 2
3 Comments
 
LVL 22

Accepted Solution

by:
David Atkin earned 500 total points
ID: 39779691
How was the server cleaned after the hack?

Also, was the hack an issue with Cryptoblock (or something similar) on a networked PC or an actual security breach?

I'd start by checking all auto services to make sure that they are started. Please check and report back.

Check Share and Security permissions.

Check free disk space.
0
 
LVL 2

Author Comment

by:ibexsystems
ID: 39779910
I removed the program bath files and vb scripts

checked the batch files and vb scripts before removing them deleted the registry entries that the vb script and batch files made..

deleted the users that where created and transposed the rdp port to make it a little more difficult to access

also changed all passwords on the server...

all the automatic services seem to be starting fine so does the share and security permissions.

as I said above the server can access to shares on itself.

*** looks like it was a problem with Sophos and the built in firewall has gone crazy re rolled out the Sophos client and it working fine now..
0
 
LVL 22

Expert Comment

by:David Atkin
ID: 39779950
Good catch.

Thanks for letting us know.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

If you are a user of the discontinued Microsoft Office Accounting 2008 (MSOA) and have to move to a new computer running Windows 8, you will be unhappy to discover that it won't install.  In particular, Microsoft SQL Server 2005 Express Edition (SSE…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now