thanks, I sent a message to the isc.sans.org via their webpage. The only accounts on the machine are local accounts however, some of those accounts (IIS accounts) had administrator access group assignment.
this is a server built by a vendor years ago so I'm not sure I can rebuild it here. What I'll do is talk with them concerning the accounts and required groups and password changes and see if we can do it that way... if not they'll have to rebuild it. thanks Andrew and Matt for replying, bob On Wednesday, June 14, 2006 1:02 PM, Colbeck, Andrew <[EMAIL PROTECTED]> wrote: >Bob, drop an email to the handler on duty at http://isc.sans.org/ for >some general advice. They may also have some specific reference to >point you to regarding a vulnerability or they may recognize the modus >operandi of what you saw. I don't recognize it, myself. > >Generally speaking, your best bet is to take that machine offline and >rebuild it from known good sources. > >Andrew 8) > > >> -----Original Message----- >> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On >> Behalf Of Bob McGregor >> Sent: Wednesday, June 14, 2006 11:37 AM >> To: Declude-List >> Subject: [Declude.Virus] the ebay spoof spam stuff >> >> this is a bit off-topic but >> >> we had one of our servers last night have the ebay spoof page >> loaded on it. Anyone have info as to how this gets loaded >> and, more imporantly how to keep it from happening? >> >> The only things I found was the htm page that was referenced >> in the spam e-mail and a folder on the desktop named sign >> in_files with the images associated with the page. >> >> I want to keep it from happening again. >> >> thanks, bob >> >> >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> >> > > >--- >This E-mail came from the Declude.Virus mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.Virus". The archives can be found >at http://www.mail-archive.com. > > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
