Today, when i have checked my server, i have seen in My Server (Windows-Server 2003 Stnd. with SP-2)that one unknows User is showing on my Login Screen. Its name was "zj2631$" and it got Administrator Privilages. it has accessed these folders and files named are:-
saomiao -->
1. 扫描 -->
jimo.bat -->
#########################################
@echo off
color B
title ¼ÅįרÓðæ
echo 125.109.1.1 125.109.255.255 >ip.txt
ip.txt
pause
copy %windir%\system32\cmd.exe cmd.exe >nul
FOR /F "eol=A tokens=1,2" %%a in (ip.txt)
do s.exe syn %%a %%b 80 /save
for /f %%a in ('findstr /i "Open"
result.txt') do echo %%a>>host.txt
del Result.txt >nul
##########################################
2. saomiao -->
a) cmd.exe
b) IP.txt
c) jimo.bat
d) Result.txt
where these files contains the following things:-
a) cmd.exe --- it's Command promt.
b) IP.txt ---- it's showing the following list:-
125.109.1.1 125.109.255.255
c) jimo.bat ---- its showing the following things:-
@echo off
color B
title Special edition of Lonely
echo 125.109.1.1 125.109.255.255 >ip.txt
ip.txt
pause
copy %windir%\system32\cmd.exe cmd.exe >nul
FOR /F "eol=A tokens=1,2" %%a in (ip.txt) do s.exe syn %%a %%b 445 /save
for /f %%a in ('findstr /i "Open" result.txt') do echo %%a>>host.txt
del Result.txt >nul
d) Result.txt It's showing the following things:-
----------------------------------------------------------------------------------
Performing Time: 5/18/2009 4:29:40 --> SYN Scan: About To Scan 65279 IP Using 1 Thread
125.109.3.37 135 Open
125.109.2.229 135 Open
125.109.3.10 135 Open
125.109.3.201 135 Open
125.109.3.229 135 Open
125.109.4.41 135 Open
125.109.4.155 135 Open
125.109.6.84 135 Open
125.109.6.183 135 Open
125.109.6.241 135 Open
125.109.6.168 135 Open
125.109.7.87 135 Open
125.109.8.48 135 Open
125.109.8.120 135 Open
125.109.8.207 135 Open
125.109.7.118 135 Open
125.109.9.34 135 Open
125.109.9.115 135 Open
125.109.9.52 135 Open
125.109.10.108 135 Open
125.109.10.89 135 Open
125.109.11.111 135 Open
125.109.11.27 135 Open
125.109.5.124 135 Open
125.109.12.84 135 Open
125.109.13.3 135 Open
125.109.12.73 135 Open
125.109.6.107 135 Open
125.109.10.237 135 Open
125.109.13.71 135 Open
LastIP Scanned: 125.109.15.133:135
125.109.13.176 135 Open
125.109.13.224 135 Open
125.109.13.228 135 Open
125.109.13.127 135 Open
125.109.15.0 135 Open
125.109.14.240 135 Open
125.109.13.214 135 Open
125.109.14.198 135 Open
125.109.15.85 135 Open
125.109.6.183 135 Open
125.109.15.93 135 Open
125.109.8.123 135 Open
Scan 3716 IPs Complete In 0 Hours 0 Minutes 5 Seconds. Found 42 Hosts
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Performing Time: 5/18/2009 4:30:3 --> SYN Scan: About To Scan 65279 IP Using 1 Thread
125.109.2.28 445 Open
125.109.4.155 445 Open
125.109.5.124 445 Open
LastIP Scanned: 125.109.18.173:445
Scan 4524 IPs Complete In 0 Hours 0 Minutes 2 Seconds. Found 3 Hosts
-------------------------------------------------------------------------------
I have run the Hijekthis v-2.0.2 and it shows this result:-
####################################################################
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:57:51 PM, on 5/18/2009
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP2 (6.00.3790.3959)
Boot mode: Normal
Can someone do some favour to remove or check this, what happen with that system. On Server MacAfee Anti-Virus is running and when i have checked this from my Laptop where AVG is installed, it shows one Alert Message while accessing that server for a virus:Trojan Horse Genric5.hnp
serves you right honestly.. you should use a secure system for a server.
That's trashed.. only solution is a ground up reinstall.. far too compromised as the exploit has allowed the person in and they have replaced core parts of your operating system.. and haven't cared that you can see the changes..... that means there are more subtle changes.. like user accounts with wheel/admin rights also.. game over.. reinstall. I suggest something designed for servers like slackware.
And take it offline immediately.. you are running hidden ftp servers and you don't want to go to prison for distribution of illegal content do you?
can I make a quick comment.. I hope you aren't running this server for a business.. or commercially.. If you can't read from the scans that it's beyond saving you really shouldn't be in charge of a remotely administered server. You can use this as an opportunity to learn about server rootkits and remote exploits... and why 95% of the internet and servers don't run windows server rubbish.
I am really thankful for your valuable Comments. I appreciate what have you said, but that is live Server which i can not re-install. Almost 100 Users are using that Server, many Sites has been hosted from that Server. So, Re-installation and its again Configuration takes around 6-7 days time and we can not wait our resources to use Server. So, we need help to repair that Server and make it safe by that kind of Attacks in future.
Kindly give some info about Remote exploits,Wheel/admin Rights and how can we protect our server by these kind of attacks.
i have blocked the IP range 125.109.1.1 125.109.255.255 which are opened by this attack, by ISA Server for all protocol. what should i do to resolve its infection and remove it from my server.
