the word is that hackers have uploaded other tools to compromised servers.
nmap, backorafice, etc. The next step is to use these machines for DDOS
attacks.
since guest is admin, that makes it easy.
want to find a machine to make a zombie? their knocking on your firewall.
If a machine has been compromised, and you didn't unplug the network cable
when it started, the only way to be sure is to reload from backup or fresh
media.
unless you're sure you can find ALL possible hacks that might have been
uploaded to the machine.
IMO.
Dan
-----Original Message-----
From: Tiffany Belcher [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, September 19, 2001 11:36 PM
To: NT System Admin Issues
Subject: Re: HELP VIRUS ON NT MACHINE?
Okay so I got the patch and cleaned up the server. It left about 7000 files
on it. I searched un 9/19/2001 and found them and deleted them all. so the
question is DO I WIPE IT AND REINSTALL? It works. THe websites work fine.
THe only problem so far is when I try to update to explore 6 it says that a
previous update didnt finish. THere is so much on this server that it would
be a pain to reinstall it again. Advice?
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
This e-mail may be privileged and/or confidential, and the sender does not
waive any related rights and obligations. Any distribution, use or copying
of this e-mail or the information it contains by other than an intended
recipient is unauthorized. If you received this e-mail in error, please
advise me (by return e-mail or otherwise) immediately.
http://www.sunbelt-software.com/ntsysadmin_list_charter.htm
