Windows Forum

Ask something
Discussion Locked

Hacked...please help

0 helpful
3 replies

by sturner

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

HAcked...Please help
Our company had a wide format print server installed and like an idiot I did not secure the box. Well needless to say some Warez Pirate got ahold of her because the local admin password was left blank. He installed a virus "W32.Pinfi":

http://securityresponse.symantec.com/avcenter/venc/data/ w32.pinfi.html

and setup a servu FTP server......

Since the FTP server and serivces have been removed, system is lock down and virus has been cleaned (had to go into safe mode to do this one)

Still I have a remaining issue that is leading me to have to rebuild the server, but I would really perfer not to. This is the issue:

The control panel is locked down: access denied! Also all .exe file act like they can not find themselves when executed?

Any Ideas or help!!!! Please

Stephen Turner

3 replies

by joseph moore

>all .exe file act like they can not find themselves

I would open up Regedit on this system and go to:
HKEY_CLASSES_ROOT\exefile\shell\open\command

Make sure the Default entry = "%1" %*

Some virii add themselves to this entry, so that every time ANY .EXE file is launched, the virus is also launched. So, check out there to see if there is some viral code there.

>The control panel is locked down
I would check out the NTFS permissions on C:\WINNT\SYSTEM32\CONTROL.EXE
This is the actual EXE file called when you try and open the Control Panel.
The default rights are that Administrators have Full Control, Everyone has Read & Execute.
So, check them out.

hope this helps

by sturner

You are the man Mr. Moore! Your fix for the registry was dead on and fixed all of the issues even the access denied to the control panel issue. You just saved me 2-3 days of work that would have been required to rebuild. I wish I could buy you a 6 pack but you do get the points!

This discussion is closed to new replies.