SamChangePasswordUser2 and Apache hack

Oh boy. What you have described here is pretty serious.

These systems have been compromised. The fact that you have found a file that details password information awaiting forwarding or retrieval AND a potential delivery method (that is usually what a "bot" does) would suggest that your entire network may be suspect.

I would NOT recommend that you put these systems back into production. The persistent little bot must be coming back from somewhere;, via another program or by repeated breaches. Your best bet for this issue is to restore from backups dating back to BEFORE the breach occurred.

If it was _my_ LAN, or my customer's LAN, I'd be launching a proper investigation, tracing logs and looking for admin accounts and rootkits on all of the servers. I would pull these two servers as a start, back 'em up on brand new media to retain whatever evidence there is left, and then re-install the OS from scratch. Then restore data carefully from older backups.

Next step would be to run a vulnerability scan on everything, and then an organized hardening of all of the systems. Password changes all around, and scan again.

I would also use the backup I created of the compromised system in an isolated lab to glean what Ican about how and when the breach occurred.

You may need the help of a security team or consultant. This is serious stuff.

If you want to stop it from happening again, you need to plan. You need a good policy set, a firewall, an IDS system and maybe even a honeynet. You need to monitor all of these things properly, and consistently.

1) If you keep deleting the bot, and it keeps coming back, then it is hiding elsewhere in the Win2K box. I suggest you check the startup portion of the Registry to see if it has written itself there (it probably has). The easiest way to do that is to get MSCONFIG for Win2k:
http://www.insideproject.com/showguide.cfm?guideid=31
Download and install that. Then just run MSCONFIG from the Start -> Run line. Click the Startup tab. If you see something suspicious, uncheck it and reboot. After that,run a full anti-virus check. A lot of the anti-virus programs detect bots as virii. They really aren't virii, but you say potAto, I say potato!
Programs like NetBus, Sub7 and BackOrifice use bots on their own ports to control remote systems. I recommend you do a full port scan against this machine from the outside (do it across the Internet from your home) and see what ports come up. There are dozens of port scanners. One I like is SuperScan, from Foundstone. YOu can get it here:
http://www.foundstone.com/knowledge/proddesc/superscan.html
(please remove any spaces)

And yes, GET A FIREWALL NOW!!! Zone Labs makes ZoneAlarm. It is free, and good.
http://www.zonelabs.com/store/content/home.jsp

Its not the Microsoft problem, because its a local user, not tsInternet user, that is being broken.

It also doesn't help that the client didn't have an administrator password on (not my fault, he changed it illegally).

This question was closed by the author