Windows Forum

Ask something
Discussion Locked

L0rd_Byr0N

0 helpful
6 replies

by russellrl2 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
One of my Windows 2000 servers (running IIS to support ARCIMS application) was hit by L0rd_Byr0N. Instead of a page not found the http://(server name) gets their hacked message. Nothing has changed on this server for over a year. How did they get in (IRC) and more importantly what do they leave behind. Already someone came in behind them and setup a Serv-U FTP site. Having a hard time finding where they got in. Reformating the hard drive is not an option at this time. Any help on this would be appreciated.

6 replies

by bfilmfan

I'd say you need to scan the server for known hacks, root kits and viri.

And if you have a backup, why is reformating the drive not an option? You do have a backup don't you?

by russellrl2

Backup is not the issue. Reinstalling the software and getting it to behave is the issue. Not all software installs and does what it claims to do.

by infoguy

I know this is not the answer you are looking for, but the only safe option here is to reformat. No matter what av or malware detectors you run, you can NEVER be sure you have cleaned everything out. By not reformatting, you are leaving yourself open to future data and/or confidentiality breaches, as well as potential legal issues. I have been doing this for 10 years now and I have seen my share of infections on client machines. I very strongly suggest you do whatever it takes to rebuild that server.

This discussion is closed to new replies.