Server hacked or What?

Hi Gals/Guys

My server is behaving very strangely from last 3 days. What happening is that it get restarted automatically after showing that screen of memory dumping. I checked the services and found that few of them are really strange although some of them were disable but they really look fishy.

I have attached the snapshot of the services.

I asked my Manager about this and he told me that this happened 5 months ago and he had to re-install the OS ‘cause he couldn’t find a solution to rectify this problem. Apart from services I am also attaching few of the logs which look really strange to me. Hope you people can help me.

My AV is updated, windows is also updated, I have scanned the system 2-3 times for viruses, Microsoft antispyware is also running.

Operating System is Windows 2003.

Awaiting your replies

Okay heres what I'm seeing(going to be doing some talking out loud so bear with me). The first unusual happenstance is at 2/10/2006 10:28:49, where a computer with the hostname of "FAIZA$" attempts to connect. Simultaneusly the MCshield service fails. I know that its a multi-proc system so it is entirely possible. Don't know if thats related.
There seem to be a lot of invalid users trying to connect. Do you have firewall logs as well? Because then we could check to see if these users are coming from the same IP/MAC address.

Heres the list of users that are invalid:
KHIDAYAT
IHAFEEZ
MUNAZZA
IMRANYOUNUS
TEHSIN
ZIAULHAQ
KNAFEES
(note this list is by no means complete)

And those names repeat quite often.

Hmm, strange, yet another "stop error" occurred when the user FAIZA tried to connect...

This could also be a problem: "The CPUs in this multiprocessor system are not all the same revision level. To use all processors the operating system restricts itself to the features of the least capable processor in the system. Should problems occur with this system, contact the CPU manufacturer to see if this mix of processors is supported."(bold added by yours truly)


The many, many, many attempts to connect by unauthorized users worry me. If you have firewall logs and tcpdump/windump information we would be able to help you better. Of course also follow up on the processor problems. I think thats the most likely issue.

Ok... as far as services go...


WTF is a Gray Pigeon Server?
WTF is Chong3 Me?


Just curious... I don't work with Windows too often, but these seemed odd....

Both the services are virus attempts that i managed to disable.

Locked

All these are my internal users.... I mean authorized users. I am not sure my i am receiving this invalid users, they are defined in AD and as well as DNS

There are some funny services there which are disabled but i see your mcsheild is
getting terminated check that you don't have anything running on the machine that
is not suppouse to be there.

There seems to be a whole bunch of netlogon failures and sign on failures.
Some of these errors suggest your client tries to sign or seal the
secure channel or something to that extent. I would check and try to disable
"Digitally encrypt or sign secure channel data (always) policy". I could be way
off but check your secure logons anyway.

Also another error suggest that machine account failed to authenticate, which is
usually caused by either multiple instances of the same computer name, or the
computer name has not replicated to every domain controller.
Hope this helps you.

AFAIK Gray Pigeon is an OpenSource(?) RAT (Remote Access Trojan)..

http://www.megasecurity.org/trojans/h/hgz/Hgz_all.html
http://www.sophos.com/virusinfo/anal...graybrdam.html

I highly recommend taking the server off-line.. Backup the important data and reinstall from original media..

That's what I figured.


It's not enough that they are disabled. They have to be REMOVED.

And since you seem to have been rooted... Reformat/reinstall.


It's the only safe thing to do.

About those failures logins, all of them are the users which are not on Domain so thats why we are getting message from them.

Well i have done the thing.... Reinstallation..... The last solution for Windows n best i think cause if you are not getting at the end of the problem, take the backup and wipe out the windows.

Anyways d0pp you said disabling the service is not enough i should remove them, well that what i wana know now. Is there a tool available to delete the services completely from the system for windows?.

Have you been making any configuration changes to this box? There are some odd entries in that log -- disabling of lots of services (SavRoam, Smart Card, RSoP, Remote Registry, Mainboard Monitor, Distributed Link Tracking Client) is the most surprising.

@tt!tud3

As i said that after getting that screen dump problem, i looked into the services and every service i found fishy i disabled it...... After doing that system starting too much trouble....

Anyways if you see the screenshot and come to service Mainboard Monitor and see its description its showing something relating with FTP access to clients although the service name has no connection to FTP so looks fishy too me few of the others looks suspicious or useless so i disable them.

What do you mean by server? A computer? Or simply a software running on the computer.
And about the memmory bumping screen, tell me more about it, I mean that it says on it. Try to disable the "Automatly reboot on error" you will disable this from somewhere in double-click My Computer > Properties > System(or Settings, I don't remember). I don't remember actualy the menu, I haven't run Windows for some time. :)
Anyways, try to send me some logs from the Minidump folder(c:\Windows\Minidump).

Goodluck! :)

Ignoring Somefilename's post for now.

Quote:

---

Anyways d0pp you said disabling the service is not enough i should remove them, well that what i wana know now. Is there a tool available to delete the services completely from the system for windows?.

---

this was in response to what d0pp said

Quote:

---

And since you seem to have been rooted... Reformat/reinstall.

---

This seems to be a common misconception. There is a big difference between a common virus or spyware and being rooted, although they could lead to the latter, though not necessary for the end result, and not necessary the end result. ( am I being too vague here? ).

Many anti-virus programs or tools can detect and remove common consequences of known viruses, but all they do is look for and remove known patterns. Once a box has been rooted there may very well be unknown and undetectable changes which would allow someone to not only be immune to common removal attempts, but also be alerted to such attempts.

What the hell does this mean? .... .... .... drunk and thinking .... .... ....

For most; reformat, reinstall, then find out how it happened and attempt to prevent it.

For programers and developers, another story.
Data is data, programs are programs, and never the twain shall meet!!!!!!!

That should get things stirring!

Somefilename

I think a server means a machine that is serving different nodes which we call clients. Yes its a machine, running Windows 2003, and serving as Proxy and mail server.

About memory Dumping, its normally a blue screen that pops up, with lots of information on it like if you have received this message first time please restart your computer and like if you recently installed any hardware, disable it and try restarting your computer.....

The important thing is some information with code 0x0000008e (0xc0000005,
0x80839148, 0xf7546c60, 0x00000000) although its already been attached with my post.

As far as log from minidump folder well dont have that with me cause as i have already said i have reinstalled the Operating system.

I have no other option to reinstall as it was a server and can't depend on Backup machine since i was not able to get the problem sorted out.

Hi gals/Guys

Now as you know i have re-installed everything, the server worked fine for few days but yesterday in evening, it showed that same F##King error window and got rebooted. I checked the log nothing suspicious.

Now is it to do with hardware, i mean aparently thats the only thing that remains the same before the installation and after installation.

Can it be some RAM issue, cause normally RAM do such thing...... Guys i really need help in this, cause the problem is getting out of hand now.

Hmmm, kinda think about it, I had this problem when I was on Windows(the exact problem). Check for some twisted capacitors on the motherboard, reinstalling won't help. :|

Somefilename I will try to see that....... But can't you remember how you solve this problem?.

Looking over the event log shows the last message before the reboot is:
2/10/2006 10:04:33 AM EventLog Error 6004
A driver packet received from the I/O subsystem was invalid. The data is the packet.

This error is not usually critical but is usually indicative at some sort of network driver/filter problem. This could be the actuall driver, or something hooking the NDIS, like a rootkit or even just your anti-virus. Now lets look at the next interesting event after the reboot:

2/10/2006 10:18:00 AM Save Dump 1001
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x80839148, 0xf7546c60, 0x00000000)

A bugcheck status of 0x0000008e or 8e, is a KERNEL_MODE_EXCEPTION_NOT_HANDLED error. The information in parenthesis is the exact address of the code that cause the unhandled exception. Since the last event before the exception was the 6004, it looks like the network driver/or filter is taking big ****. I'm still nit sure whether this caused by hardware or software (aka re-infection, AV, etc) You need to eliminate the possibilities. I would try this:
First, boot to a memtest CD and test the memory. Then move the NIC card in the server to a different slot. Make sure you have the newest drivers from Intel for the card, and let the machine run. If if it still crashes, move it to an isolated network and remove AV software and anything else which may be hooking the network drivers. Give it some kind of network activity and let it run. Post back with anything you may turn up.

-Maestr0

Could be the Law of Synchronicity is at work here. On the one hand, it certainly sounds like you've got some hardware issues. I was just looking at a W2K box yesterday in which the owner had inserted another ram chip which was picked up by the bios ok, but gave the OS fits, throwing us all kinds of errors in ass't .exe files. We removed the new chip and everything ran great. The computer used pc100 and the owner had put in a chip of pc133u thinking it was backwards compatible. Oddly, the bios found it ok, but it choked both W2K and Insert linux (boot cd).

But that may not explain the rogue software you've been plagued with. What kind of media are you installing the server software from? A Microsoft factory cd? Or perchance something from a warez site?

brokencrow

Well i am installing from a backup CD which we have been using from a while, as we don't normally purchase licensed software here ;).

Well my mind is going towards RAM, cause there are 4 different RAM in it, 1 X 512 MB and 3 X 256 MB. We have been facing some power fluctuation issues here altough the server is on a heavy UPS so this couldn't damage things here..... I took all the RAM out and examine myself couldn't find any burn one in it.

The other thing i have in mind is that power supply, the only reason i couldn't getting to the exact cause of this problem is because I can find any resemble incident in b/w all those reboots. Nothing similar happen.

Just one more thing i remember before re-installation when i encounter this problem first, my Manager take a look into the services and disable lots of services he thought might be not worthy for us and this memory dumping problem occurance increases rapidly, i mean it normally used to happen once or twice in a day and after stopping few services it used to happen more than 5 times in an hour or rather i must say occuring every 10-15 mins.

So i am really confuse is it some software issue or hardware. ??????

Hi Gals / Guys

As mentioned in the post one of the issue that we were facing with our server a while ago, well it wasn't resolved and we had to change the server eventually. i was working on that old server rather i was using it and what happen on Thuesday, i Updated windows as it was showing me that there is an updation of ISA server 2004 it was SP2....... And after updation ..... The server gets back to normal condition...... its been a week and thanks to GOD its working perfectly alright not even had a problem with the machine for a single time.....

So i have came to the conclusion that ISA 2004 SP1 has some issue with this Server Machine Intel STL 2.0 Motherboard.

I am glad, its Over....
Thanx & have a nice time.