Security

Ask something
Discussion Locked

WINVNC ABUSE

0 helpful
7 replies

by yogi7 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello my name is jeff, I work for a non-profit organization in Hawaii. we recently installed a RAS server, and it worked fine for a couple of weeks, now it no longer works cannot even access the internet and cannot use the programs on the server, When I did a shut down to safe mode, and reboot, I saw WINVNC pop up with contol of mouse pointer and keyboard clicked, I unclicked them and got a warning message that connections would not be accepted, this is the Problem, this program was never installed by me or anyone else in our organization, Some hacker has basically hi-jacked our ras server, I have disconnected the modem and ether net cable so it is no longer accessible (I think), what I would really appreciate is if you can give me any ideas for combatting this situation. I plan to fdisk, reformat, reinstall, add most recent anti-virus and firewall. Will the Fdisk and reinstall help me remove the program from our RAS server? Also we have a dynamic IP address -- so I think that willhelp us also. Please if there is any information, or suggestions you could provide we (at our organization would deeply appreciate it.

Thanks - JC

7 replies

by tduval

If you've really been hacked, the only security response is : fdisk, format, re-install.

Add anti-virus, firewall, and close all open ports.

by alveden

Here are the procedure we use to when responding to a hacked system.

1. Dump an image of the Hacked system, and save it.
2. Fdisk, format, reinstall OS or dump from backup (if you keep backup and can confirm that the backup were not comprimise).
3. Install necessary application (in your case, anti-virus and firewall ... don't you have a dedicated firewall.)
4. Tighten the Operating System.
5. Bring Server back to production.
6. Dump comprimise OS into a server place in a isolated network.
7. Investigate and analysis the hack system.
8. Identify the method and the level of the comprimise.
9. Find a solution to prevent penetration of similar nature in the future.

by vinnyd

I have seen this on a few windows 2000 installations now.

Where the WinVNC box comes up after rebooting.

The norton antivirus finds and quaritines the virus but the customer kept getting it back.

I just turned off the Messenger Service in Win 2000 and that stopped the user from getting re-infected.

They also were on a dynamic IP address.

This discussion is closed to new replies.