Holes in Windows2000 Advanced Server

[kagawad]

I am newly working in a local government owned I.T. office and their server is Windows2000 advanced server. Now, my problem is, lately the server hangs every 15 minutes and an antivirus always prompts some viruses that cannot be repaired or quarantined. Does it has a possibility that the server has a hole and it has no tight security. It does i know If so, what is the security tips that you all can give. any security software to download? or configuration of the server itself. please help. thank you

[littlenick]

It means that file may be in use so it can't be deleted or may be some other reasons it is not related to OS bugs it is related with either file permission or antivirus or file type what OS are you using ?what Av are you using?
What is the file name that can't be deleted ?
provide us full file path.
Did you update your AV

[kagawad]

Am using Windows2000 and my AV is Norton Anvtivirus Corporate Edition. I just "live updated " that AV a while ago. oh, and i was just finished updating and installing the windows to service pack 4.

[morganlefay]

Are you running Exchange on that server??

DO NOT scan the M:\ drive if you are!!!!

There are some KBs at symantec on how to configure Norton CE on a server..you may want to check out.

http://service1.symantec.com/SUPPORT...&ver=7.6&tpre=

Also what version of Norton CE are you running...
Any other services on the server???

MLF

[CXGJarrod]

Preventing Norton AntiVirus Corporate Edition from scanning the Microsoft Exchange directory structure

http://service1.symantec.com/SUPPORT...00110108382448

You also might want to check out this article. (didnt see it directly listed on the morganlefey's link)

You are the admin for this network correct?

Is this an internet facing server? Do you have a firewall (software or hardware) between this machine and the internet?

If it says that it cannot quarantine or remove the virus, can you tell us the name of the virus so we can point you to a removal tool which might work?

[PuReExcTacy]

Since your antivirus seems not to be able to remove the virus while the system is up, you might want to create a bootable cd or diskette from an antivirus program, make sure it's updated, and reboot the system with the cd or diskette inside. This will boot directly to the antivirus, and it should hopefully scan all the drives and remove any infected files it finds.


--PuRe

[kagawad]

I dont have any Microsoft Exchange in the server. And am using Norton CE 7.x versions. No big services except that these is the Web Server and Database perhaps. Dont know yet what other services to put bcoz am new and its just newly formatted. No it doesnt have "any" firewall yet in between. Viruzes here includes: o, wvsvc.exe, winole.exe, specialfile.exe, delete_this_file.exe, x.exe, winhlpp32.exe, a lot of TFTP*'s and .pif's.

[CXGJarrod]

Originally posted here by kagawad
I dont have any Microsoft Exchange in the server. And am using Norton CE 7.x versions. No big services except that these is the Web Server and Database perhaps. Dont know yet what other services to put bcoz am new and its just newly formatted. No it doesnt have "any" firewall yet in between. Viruzes here includes: o, wvsvc.exe, winole.exe, specialfile.exe, delete_this_file.exe, x.exe, winhlpp32.exe, a lot of TFTP*'s and .pif's.

Have you patched this server in a while? You may be having trouble from an IIS worm.

Also check out the IIS lockdown tool.

http://www.microsoft.com/downloads/d...DisplayLang=en

and this guide

From Blueprint to Fortress: A Guide to Securing IIS 5.0
http://www.microsoft.com/technet/pro.../securiis.mspx

Are the Frontpage extensions installed?

[kagawad]

thanks a lot people...

[yourdeadin]

well in my college we also have the same problem when ever there is too much load in the Terminal server,as per my experinecesthis might not necessarly be a virus doing, too much stuff in the terminal server may also be a way to your server getting stuck

i may not be right but i am not wrong

plz free up space in your terminal server,
and i sincerly hope that you windows 2000 server is updated