Windows Forum

Ask something
Discussion Locked

I am a DoS Attack Zombie - HELP!

0 helpful
5 replies

by duffy_jenna

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Dell Hosting has just informed me that my company's NT web server has been sending out DoS attacks against other machines. They will not attempt to remove them. Does anyone know how I can find and remove these remote zombie/bots that are installed on my server?

5 replies

by joseph moore

Well, I would open Task Manager and see if there are any foreign programs running in the Processes tab. IF so, End Task them.

by duffy_jenna

Thanks, but that was the first thing I did. Since they are not running until called upon, they do not show up. I did find that they (the hacker bad guys)installed DameWare Remote Controller and I did uninstall it. But the zombies are installed somewhere else.

by james r linn

Most anti-virus software will remove these pests, but it would be more helpful if Dell told you which one is installed. You could then ensure that you had anti-virus software with the correct definitions file.

If anti-virus software doesn't work,and you know the name of the program, go to www.cert.org and do a look up - there will likely be instructions there on how to remove it.

If this approach doesn't work, the easiest way, assuming you have good backup procedures, is to ensure you have a copy of the data files(and ensure there are no rogue .exe files lurking), format the server and reinstall the OS, and web server, then the data.

Be sure that once you have everything back, that you go looking for the necessary patches whichwill help ensure you dont have a re-occurance.

James

by duffy_jenna

I agree, Dell should have told us. They said they don't know either. I had Norton on the server but I guess it didn't help. I just updated the definitions before this happened, but since they sit dormant until called, I don't know how long they have been on there to compare from backup. I do unfortunately agree that I will have to format the server and start again. I was just hoping to avoid it.

Thanks anyway!

This discussion is closed to new replies.