Discussion Locked

MS IIS4.0 iusr_sysname account security

0 helpful

3 replies

by huawh Aug 2, 2001 last reply Aug 5, 2001 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Internet site set on the NT4.0/IIS4.0 platform.
We doubt that the site is attacked by hackers. Event log shows someone use the iusr_sysname account to log on and get into the iis process. The web service is stopped by him. How can we prevent this?

3 replies

by mebudman Aug 3, 2001

Get the CODE RED patch to fix this,at

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-033.asp

Check your IIS logs and search for the string "default.ida". And yes you are being hacked.

We saw this behavior and applied the patch and everything was fine after that.

by huawh Aug 5, 2001

I downloaded a whole patch for iis4.0 from Microsoft.com, which includes the patch in answer1. Thanks.

by huawh Aug 5, 2001

This question was closed by the author

This discussion is closed to new replies.

3 replies

Trending Security posts

What Are the Most Important Security Steps for Protecting a Home PC

What is the most effective way to protect your personal information online

Is it possible to create a secure community forum

LiteLLM SQL Injection Vulnerability (CVE-2026-42208)

How do you go about MCP Security?