I've been helping a little hosting company. They have servers offering .NET hosting with Windows & IIS. For clients management, domain creation an this kind of stuff they're using Paralells Plesk which works well.
It seems that in the process of generating statistics 'Perl.exe' is used to parse IIS log files. Today we've found that some users are infected by a DOS system called Gootkit. A lot of malicious scripts are found in the cgi-bin folder. I don't know exactly how, but they are invoked somehow (and executed via Perl with his IUSR user).
We have isolated these scripts and the problem has stopped by now. We also added a false route in Windows to the destination IP of the attack in order to prevent the output of the traffic.
Beyond these specific reactive actions, I was wondering: what is the correct checklist that you have to follow to prevent these issues in the first place? Currently, Windows Firewall is active and running, Kaspersky AV is in place, and there is a hardware firewall in place. However, simple upload and invokation of these scripts has induced the network interface to work at 100% affecting all the machines of the datacenter.
How can we do a better job of protecting our servers?