Website hacked

Our website has just got deface. I thought the problem is just the index. htm or default. htm being rename. I deleted them but the offended page still pop up. This is the first time for us and I don't know how to start.

Windows Networking 2246 This topic was started by bytemangler, 2001-05-08 14:58

Discussion 8

bytemangler

114 Posts
Location -
Joined 2001-02-27

#48691

2001-05-08 16:58

Our website has just got deface. I thought the problem is just the index.htm or default.htm being rename. I deleted them but the offended page still pop up. This is the first time for us and I don't know how to start. Can any of the network admin help me out please...thanks in advance

and

Grouping of Taskbar Buttons Doesnt Work??

DSL Router.....Which to pick?

Participate on our website and join the conversation

You have already an account on our website? Use the link below to login.

Create a new user account. Registration is free and takes only a few seconds.

This topic is archived. New comments cannot be posted and votes cannot be cast.

Responses to this topic

clutch

3857 Posts
Location -
Joined 2000-03-29

#48692

2001-05-08 17:53

If you are using "includes" on those pages, then you might want to check all of them. Also, make sure there aren't any EXEs running that will switch the page back if it's removed. There may even be some DLLs registered that are doing this as well. If all else fails, you could just delete and restore portions of the site or the whole thing from backup. You should also try and put on some of the IIS updates that may pertain to you ( www.microsoft.com/technet ).

bytemangler

114 Posts
Location -
Joined 2001-02-27

#48693

2001-05-09 16:30

I think there is some EXE service running in the background that put the index.htm and default.htm files back on a scheduled time. I remember removing these files and reboot the system. Any idea how to find out where the file could be?

Thanks

clutch

3857 Posts
Location -
Joined 2000-03-29

#48694

2001-05-09 17:16

Generally, when you look at the process tab in Task Manager you can pick these out as hackers tend to have a sense of humor about these. Also, you could do a search on any exe files that don't look familiar, and see where they are located and what their "created" dates are.

bytemangler

114 Posts
Location -
Joined 2001-02-27

#48695

2001-05-09 17:51

I forgot to mention the worm. It was the Anti-PoizonBox message.
"f**k USA Government
f**k PoizonBOx
contact:sysadmcn@yahoo.com.cn "

CrazyKillerMan

757 Posts
Location -
Joined 2000-10-14

#48696

2001-05-10 10:07

sorry for my ignorance...but wtf is a 'poisonbox'

DosFreak

3867 Posts
Location -
Joined 2000-02-04

#48697

2001-05-11 06:19

Interesting.... I was going through my Sidewinder logs and noticed a website that said the same thing. I flagged it for later study. Thanks for the reminder!

Intlharvester

90 Posts
Location -
Joined 2000-04-25

#48698

2001-05-19 21:14

You should format the disk and reinstall the OS.

At least in the UNIX world, it's common for hack kits to modify the kernel or 'ps' so that you can't see the evil process running. It's possible to do this on Windows, so you should consider all system binaries untrusted and blow them away.

miku

507 Posts
Location -
Joined 2000-01-30

#48699

2001-05-19 21:42

Well Guys that Posion Message was also in my Inetpub Directory.

Then I deleted the files from each of the Inetpub subdirectories.

After two three days they reappeared again. I deleted again. Then I updated windows from windowsupdate and now it is sound.

Are there any other security measures to be taken.

Thanks
ARC

Website hacked

Participate on our website and join the conversation

Responses to this topic

Windows

Linux

macOS

Community