1

Blank directories are being created on my Windows Server 2003 virtual server with sub directories that are weird (for example: "88ÿ ÿ ÿÿþþ þþ13þ"). It looks like they are uploading bootlegged DVDs and pirated software. All of my bandwidth and file space is being eaten up.

Could this be a shared permissions issue? Where should I look to further investigate this?

My security permissions for the directory that is being hit are as followed: Administrators - ALL GRANTED IIS_WPG - Read & Execute, List Folder Contents, Read Internet Guest - DENY SYSTEM - ALL GRANTED Users - Read & Execute, List Folder Contents, Read

My Event Viewer is showing many Logon/Logoff with NO IP?

Improve this question

4 Answers 4

Reset to default
6

Sounds bad, and unfortunately the only safe course of action is pretty drastic:

  • take the server off the network, wipe it, and rebuild it.

Hopefully you have sufficient backups... If you don't have everything you need backed up, you could add another step in there where you cautiously copy data files off - I wouldn't really trust anything except text files.

Improve this answer
4
  • 2
    Definitely this. Once you've discovered that you've been compromised, that server needs to come down with immediate effect. Repair isn't an option.
    – Chris Thorpe
    Apr 3, 2010 at 6:58
  • 1
    Actually it depends - seriously. I had a "compromised" server once - happens I allowed anonymous write in the ftp folder (which was isolated). No issue - removed files, closed hole.
    – TomTom
    Apr 3, 2010 at 7:08
  • +1 for wipe and rebuild. Its the only sure way to fix this.
    – Bryan
    Apr 3, 2010 at 7:16
  • And don't put the rebuilt server back on the network with the same vulnerabilities. Fool me once, and all that..
    – Tom O'Connor
    Apr 3, 2010 at 8:33
1

Please more info - where are those folders? C:\? Or in a subfolder of an isolated subsystem? I had a similar case once on a FTP folder (totally isolated) where I accidentally llowed everyone to upload files. Just closed the hole.

If that is, though, in a system / executable folder (website), take the server down, reinstall.

Improve this answer
0

The C:\Inetpub\wwwroot\ is the directory that is being compromised. All I did was create a website with IIS (no software installed). I then enabled file permissions for the website to allow uploads for all of the websites on C:\Inetpub\wwwroot. Permission details are showed in original question above.

As for FTP, Security Accounts are the following: ALLOW ANONYMOUS CONNECTIONS IS CHECKED Username: computer username Passord: set pw

The ALLOW ONLY ANONYMOUS CONNECTIONS is not checked.

NOTE: If I uncheck 'ALLOW ANONYMOUS CONNECTIONS', I am prompted with a warning 'The authentication option you have selected results in passwords being transmitted over the network without data encryption. Someone attempting to compromise your system security could use a protocol analyzer to examine user passwords during the autehntication process. For more detail on user authentication...' So, I did not continue with this setting.

Is this the problem?

Improve this answer
2
  • If any IIS site has execute permissions on - wipe the server. Otherwise wipe the wwwroot folder, rebuild it. Check your permissions.
    – TomTom
    Apr 3, 2010 at 7:49
  • @jreedinc: Welcome to ServerFault. For info, you shouldn't have posted this as an answer, it should either be a comment, or an edit to your original question. Please read the FAQ for details.
    – Bryan
    Apr 3, 2010 at 8:54
0

I feel so stupid.... My FTP was allowing anonymous users to access and execute files!! Be sure to uncheck Allow anonymous connections. When you uncheck it, it warns, 'The authentication option you have selected results in passwords being transmitted over the network without data encryption. Someone attempting to compromise your system security could use a protocol analyzer to examine user passwords during the autehntication process. For more detail on user authentication...'

I guess I need to setup a SSL for the FTP.

Improve this answer

You must log in to answer this question.