Jump to content
Microsoft Windows Bulletin Board

webserver hacked


Recommended Posts

Posted

Hi,

 

I run a server with windows 2000 server.

 

Today, all the sites were "hacked".

 

Probably someone run a script that on all "folders" on webserver

copy/changed the default web page.

default.asp .cfm .htm .html .php

index.asp .cfm .htm .html .php

 

I didnt have all security patchs installed, i just installed them. Due

firewall thing it doesnt do the updates automatic, i must do it manually.

I delete afected folders and repost the backups i had.

 

Everything running ok now.

 

I think the flaw used was kb928366 from .net framework 1.1 - 10/07/2007 - i

didnt have this one and some others also.

Could i be right about the flaw used?

 

If it happens again, how, or who, i can contact from microsoft?

 

thk,

PV

Guest Milo \(MSPSS\)
Posted

Call this please Microsoft Security 1866 727 2338 for such concern maybe

assist you on security auditing of what really happened.

 

 

"PV" <PV@discussions.microsoft.com> wrote in message

news:ED719C5D-591C-400A-83C6-50089535F311@microsoft.com...

> Hi,

>

> I run a server with windows 2000 server.

>

> Today, all the sites were "hacked".

>

> Probably someone run a script that on all "folders" on webserver

> copy/changed the default web page.

> default.asp .cfm .htm .html .php

> index.asp .cfm .htm .html .php

>

> I didnt have all security patchs installed, i just installed them. Due

> firewall thing it doesnt do the updates automatic, i must do it manually.

> I delete afected folders and repost the backups i had.

>

> Everything running ok now.

>

> I think the flaw used was kb928366 from .net framework 1.1 - 10/07/2007 -

> i

> didnt have this one and some others also.

> Could i be right about the flaw used?

>

> If it happens again, how, or who, i can contact from microsoft?

>

> thk,

> PV

>

>

Guest James Matthews
Posted

Now can you please give the nature of the hack? Look at your webserver logs!

See the requests for the past week!

 

--

 

http://www.goldwatches.com/watches.asp?Brand=14

"PV" <PV@discussions.microsoft.com> wrote in message

news:ED719C5D-591C-400A-83C6-50089535F311@microsoft.com...

> Hi,

>

> I run a server with windows 2000 server.

>

> Today, all the sites were "hacked".

>

> Probably someone run a script that on all "folders" on webserver

> copy/changed the default web page.

> default.asp .cfm .htm .html .php

> index.asp .cfm .htm .html .php

>

> I didnt have all security patchs installed, i just installed them. Due

> firewall thing it doesnt do the updates automatic, i must do it manually.

> I delete afected folders and repost the backups i had.

>

> Everything running ok now.

>

> I think the flaw used was kb928366 from .net framework 1.1 - 10/07/2007 -

> i

> didnt have this one and some others also.

> Could i be right about the flaw used?

>

> If it happens again, how, or who, i can contact from microsoft?

>

> thk,

> PV

>

>

>

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...