Hacked !!!!!!

u could always change his scripts a little and watch him fumble next time.

only thing you SHOULD have in C:\WINNT\system32\spool\prtprocs\w32x86 is Winprint.dll

If you run IIS, svchost.exe could be W32.bluecode.worm. check these sites for more info....
http://securityresponse.symantec.com...code.worm.html
http://www.microsoft.com/technet/tre...n/ms00-078.asp

and here's another guy who may have similar problems...
http://archives.neohapsis.com/archiv...2-q2/0121.html

interesting...
from http://www.serv-u.com/

Quote:

---

Serv-U contains many "hooks" that allow other developers to easily write their own addon utilities, tools, and DLLs to extend the functionality of Serv-U.

---

Quote:

---

With the TZO Dynamic DNS Service, you can bind a domain name to a dynamic IP address. Serv-U 3.1 supports this service allowing Serv-U to use this domain name for it's connection address and PASV data transfers.

---

he was trying to root you, to use you as a XDCC or some other kind of file server,,,I suggest you take a bood look around you system for .zip .tar .avi .rar and such, they may have uploaded some files already...

hope you get it sorted out...

- Noia

Quote:

---

noodle. I have his IP from the Savant log. 80.14.79.43

---

This is what my trace had to say about the IP:

inetnum: 80.14.79.0 - 80.14.79.255
netname: IP2000-ADSL-BAS
descr: BSTLN103 Toulon Bloc1
country: FR
admin-c: WITR1-RIPE
tech-c: WITR1-RIPE
status: ASSIGNED PA
remarks: for hacking, spamming or security problems send mail to
remarks: [email protected] AND [email protected]
remarks: for ANY problem send mail to [email protected]
mnt-by: FT-BRX
changed: [email protected] 20020214
source: RIPE

It's coming out of France somewhere.

Cheers:

i thought it was a french job... this IS french, right?

Quote:

---

¨¨°o.O0Oo+====================================+oO0O.o°¨¨

<-·´¯`·._.·´¯) Info Utilisateur (¯`·._.·´¯`·->

--={ Tu es sur le disque %Disk
--={ Ton ip %IP
--={ Utilisateurs Connectés: %UNow
--={ Nombre d'utilisateurs Acceptés: %MaxUsers
--={ Nombre d'utilisateurs connectés depuis le lancement du serveur: %UAll
--={ Utilisateurs connectés sur le serveur durant les dernieres 24H: %U24h

¨¨°o.O0Oo+====================================+oO0O.o°¨¨

<-·´¯`·._.·´¯) Descriptif Serveur (¯`·._.·´¯`·->

--={ Heure Local %Time
--={ Date Local %Date
--={ Le serveur est lancé depuis
--={ %ServerDays Jours, %ServerHours Heures, %ServerMins Mins, %ServerSecs Secs

¨¨°o.O0Oo+====================================+oO0O.o°¨¨

<-·´¯`·._.·´¯) Statistique Serveur (¯`·._.·´¯`·->

--={ Espace Disque Disponible: %DFree Ko
--={ Téléchargement Total: %ServerKbDown Ko
--={ Envoie Total: %ServerKbUp Ko
--={ Bande Passante Moyenne: %ServerAvg Ko/sec
--={ Bande Passante Actuelle: %ServerKBps Ko/sec
--={ Nombres de Fichiés Téléchargés: %FDown
--={ Nombres de Fichiés Envoyés: %FUp

¨¨°o.O0Oo+====================================+oO0O.o°¨¨

---

Looks like he uses ADSL.
This could mean that the person has hacked you from his own home computer (which would be stupid) or he has allready rooted that box.
I would definitly send the abuse and the postmaster a high priority mail.
They may still have logs of what happened and this way the person will be caught allready.
If you have no 'critical' data on your server I would keep the box running and install some sort of packet sniffer or other monitoring software and watch this closely.

Hope this helps.

O yeah, you offcourse should keep you box up to date. Win 2k has service pack 3 allready and even some critical patches after that one.

Cheers.

noODle

I believe the little bastard is as busy as a bee loading files to me right now.

How can I tell?

Is the FTP service running? I thought you shut it down.

Anyways, how's your disk space, this is one way to tell if files are being uploaded, if your disk space is decreasing (a lot) then he's likely pushing files to you. Check the directories he created in his install process.

Cheers:

Use 'netstat -an 5' from a command line interface to monitor active connections. This will give you the IP's of computers you are connected with as well as the port used for the session.
Use netstat -s for statistics on a per protocol basis.

The cracker has renamed some proggies on your box.
Rename them back to the original and use 'net share' to monitor what is shared on your box

Like I said, I'm not very good at this sort of thing but, I used the Win file search and looked for files last accesed by date and used yesterday till tomorrow as the dates

Saw a new-this-day.gz and a new-this-week.gz

Little rat is uploading stuff to my root as we speak. I wish I could smoke this sucker.

Just taking a very quick look through this thread and a couple of things come to mind. One, on the question of 'why would he disable netbios, delete admin shares', alot of times hackers will tighten up the box and fix how they got in to prevent others from doing the same...probably something he does by default...You said this box was outside in a DMZ...you did have netbios/null logon turned off right?

Also noticed that those commands are under spool, which makes me wonder if maybe he did something to exploit the NULL.printer thing (this is pretty old though). When was the last time you patched the box and IIS?

You say you have a 10 computer LAN setup at home. You have a PC that is unix? You might could set it out there in the DMZ (remove the IP or set it to something wrong so nobody can get to it). Then where the server is, connect it to a HUB (not a switch), connect the Unix box to the hub, then connect your router to the hub (might have to cross this over or use a uplink port for this connection). You should then be able to see any network traffic heading to the compromised box.

Could you please answer the following:

1) What are you running on the box? IIS? Any other services ? Take a look at Control Panel -> Administrative Tools -> Services, Are you running server, workstation, remote registry ?

2) When was the last time you patched XP? When was the last time you patched IIS (I am assuming you are running this)?

3) Have you looked in winnt/system32/logs ?

/nebulus

EDIT: Cleaned up a couple of grammatical booboos.