|
Hello there ,
Has anyone come accross a worm or an
incident where the files are getting wiped out the server runing
win2k ,
We had an incident in one of the
departments .
Our 3 servers been wiped out
�
Domain controller (win2k
server) � Proxy server / Firewall (win2k server running ISA firewall) � Mail server (win2k server running Microsoft Exchange)
the common factor in all breakins is a file called readme.bat and in the later incidents it's been replaced on to autoexec.bat.
we have currently patched the server and are monitoring the network with sniffers and IDS .... the command used in both the batch files is del *.* /s/f/q
thanking you in anticipation ... -regs Harshul n.
***********************************************************************
"The shell must be cracked apart if what is
in it is to come out, for
if you want the kernel you must break the shell. And therefore, if you want to discover nature's nakedness, you must destroy its symbols, and the farther you get in, the nearer you come to its essence. When you come to the One that gathers all things up into itself, there your soul must stay." -Meister Eckhart |
