Security

Ask something
Discussion Locked

HAcked...Please help

0 helpful
5 replies

by sturner 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Our company had a wide format print server installed and like an idiot I did not secure the box. Well needless to say some Warez Pirate got ahold of her because the local admin password was left blank. He installed a virus "W32.Pinfi":

http://securityresponse.symantec.com/avcenter/venc/data/w32.pinfi.html

and setup a servu FTP server......

Since the FTP server and serivces have been removed, system is lock down and virus has been cleaned (had to go into safe mode to do this one)

Still I have a remaining issue that is leading me to have to rebuild the server, but I would really perfer not to. This is the issue:

The control panel is locked down: access denied! Also all .exe file act like they can not find themselves when executed?

Any Ideas or help!!!! Please

Stephen Turner

5 replies

by a.jongsma

Just some ideas:

Are you logged in as the admin?
Did you try the same in safe mode?

The access denied to the control panel could be privilege related and even policy related, it might have been modified somehow.
Did you check if all privileges on the .cpl and the .exe files are still ok? They might not have execute privileges.

by sturner

The answer to the question was in a registry key that had been modified. This question was answered with the fix by a Mr. Moore in the NT Q&A. I have awarded him the points. Thank you for your attempt to assist me in this matter!

by abelnguyen

1) I suggest you try virus scan all the file in the system again, if possible with a different virus scanner. Since normally, antivirus programs are able to fix all the damage cause by virus, there might be another virus that NAV left out.
2) Try restore critical exes file from the setup CD, the hacker might modified those file while he is in the system.

by sturner

The answer to the question was in a registry key that had been modified. This question was answered with the fix by a Mr. Moore in the NT Q&A. I have awarded him the points. Thank you for your attempt to assist me in this matter!

This discussion is closed to new replies.