up vote 1 down vote favorite
share [g+] share [fb]

Our server was compromised a few days ago through a FTP server that we didn't update in time. I think I have it under control now but there's still one issue. Inbound connection are working fine but there's a problem with outbound connections.

I can't access anything through a web browser (example: wwww.serverfault.com) but I can connect via telnet with no problems. I also tried writing a simple .net program that tries to post something to a website on port 80, doesn't work...I'm out of ideas

Thanks for the help!

link|improve this question
feedback

2 Answers

up vote 1 down vote accepted

Luckily you've discovered that the server has been compromised, that's great.

Sadly you will have to wipe and reload it to ever call it "yours" again as you won't know what's been done to the system and no amount of scanning and repairing will find all root kits and the like for you.

Also, you should avoid using web browsers on a server at all as that's too big an attack vector.

link|improve this answer
+1 for WIPE and RELOAD. Really the only solution. – Dayton Brown Sep 18 '09 at 15:56
feedback
up vote 0 down vote

When you telnet, are you telnetting to a FQDN (www.serverfault.com) or an ip address? Are you telnetting to port 80?

link|improve this answer
Yes, I'm connecting to a FQDN and port 80. Any server,any port works fine – Acanthus Sep 18 '09 at 14:22
Hmmm... so connectivity to port 80 is not the issue and it sounds like DNS resolution is not the issue, and the server was compromised. Take a look at the proxy settings in IE to see if they've been tampered with (turned on or changed). Try installing an aletrnate browser to see if that works. At this point I'm in the boat with Oskar, you've been compromised and there's no way to know exactly what's happened to the server so it's probably safest to wipe it out and start from scratch, drastic as that sounds. – joeqwerty Sep 18 '09 at 14:27
Yes, wipe it out sounds like the best solution anyway, just to be 100% sure. – Acanthus Sep 18 '09 at 14:30
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.